Uploaded image for project: 'OpenShift Bugs'
  1. OpenShift Bugs
  2. OCPBUGS-30215

Azure MAO CredentialsRequest Contains Unnecessary virtualMachines/extensions Permissions

    XMLWordPrintable

Details

    • No
    • False
    • Hide

      None

      Show
      None

    Description

      This is a clone of issue OCPBUGS-29956. The following is the description of the original issue:
      —
      Description of problem:

      CredentialsRequest for Azure AD workload identity contains unnecessary permissions under `virtualMachines/extensions`.   Specifically write and delete.

      Version-Release number of selected component (if applicable):

      4.14.0+

      How reproducible:

      Every time

      Steps to Reproduce:

          1. Create a cluster without the CredentialsRequest permissions mentioned
    2. Scale machineset
    3. See no permission errors

      Actual results:

      We have unnecessary permissions, but still no errors

      Expected results:

      Still no permission errors after removal.

      Additional info:

      RHCOS doesn't leverage virtual machine extensions.  It appears as though the code path is dead.

      Attachments

        Issue Links

          blocks

          Bug - A problem that impairs or prevents the functions of the product. OCPBUGS-30898 Azure MAO CredentialsRequest Contains Unnecessary virtualMachines/extensions Permissions

          • Critical - To be worked on immediately following BLOCKER issues.
          • Verified
          clones

          Bug - A problem that impairs or prevents the functions of the product. OCPBUGS-29956 Azure MAO CredentialsRequest Contains Unnecessary virtualMachines/extensions Permissions

          • Critical - To be worked on immediately following BLOCKER issues.
          • Verified
          is blocked by

          Bug - A problem that impairs or prevents the functions of the product. OCPBUGS-29956 Azure MAO CredentialsRequest Contains Unnecessary virtualMachines/extensions Permissions

          • Critical - To be worked on immediately following BLOCKER issues.
          • Verified
          is cloned by

          Bug - A problem that impairs or prevents the functions of the product. OCPBUGS-30898 Azure MAO CredentialsRequest Contains Unnecessary virtualMachines/extensions Permissions

          • Critical - To be worked on immediately following BLOCKER issues.
          • Verified
          links to

          GitHub openshift/machine-api-operator#1222: [release-4.15] OCPBUGS-30215: Azure MAO CredentialsRequest Contains Unnecessary virtualMachines/extensions Permissions

          GitHub openshift/machine-api-provider-azure#103: [release-4.15] OCPBUGS-30215: Remove startupScript vmextension lookup

          Web Link RHBA-2024:1770 OpenShift Container Platform 4.15.z bug fix update

          Activity

            People

              bvesel@redhat.com Benjamin Vesel
              openshift-crt-jira-prow OpenShift Prow Bot
              Zhaohua Sun Zhaohua Sun
              Votes:
              0 Vote for this issue
              Watchers:
              6 Start watching this issue

              Dates

                Created:
                Updated:
                Resolved: