Feature Overview

• As a self-managed OpenShift on Azure administrator, I want to be create and manage OpenShift clusters using Azure managed identities for Azure resources for authentication, in conjunction with Azure AD workload identities to access Azure cloud resources securely in Microsoft Azure Government regions.

Goals

• As an administrator, I want to deploy OpenShift 4 and run Operators on Azure using access controls (IAM roles) with temporary, limited privilege credentials in Microsoft Azure Government regions.
• Note: The Azure MI/WI feature was introduced in OpenShift 4.14 for self-managed OpenShift (OCPSTRAT-513) and is available in all Azure regions where Azure MI/WI is available.
• This does not yet work in Microsoft Azure Government regions and Azure Stack Hub, and this feature aims to address adding support for Microsoft Azure Government regions.

Requirements

• Azure managed identities and workload identities must work for installation with all install methods including IPI and UPI, work with upgrades, and day-to-day cluster lifecycle operations.
• Support HyperShift and non-HyperShift clusters.
• Support use of Operators with Azure managed identities.
• Support in all Azure regions where Azure managed identity and Azure AD workload identity is available. Note: Federated credentials is associated with Azure Managed Identity, and federated credentials is not available in all Azure regions.

This Section: A list of specific needs or objectives that a Feature must deliver to satisfy the Feature.. Some requirements will be flagged as MVP. If an MVP gets shifted, the feature shifts. If a non MVP requirement slips, it does not shift the feature.

(Optional) Use Cases

This Section:

• Main success scenarios - high-level user stories
• Alternate flow/scenarios - high-level user stories
• ...

Questions to answer…

• ...

Out of Scope

• …

Background, and strategic fit

This Section: What does the person writing code, testing, documenting need to know? What context can be provided to frame this feature.

Assumptions

• ...

Customer Considerations

• ...

Documentation Considerations

Questions to be addressed:

• What educational or reference material (docs) is required to support this product feature? For users/admins? Other functions (security officers, etc)?
• Does this feature have doc impact?
• New Content, Updates to existing content, Release Note, or No Doc Impact
• If unsure and no Technical Writer is available, please contact Content Strategy.
• What concepts do customers need to understand to be successful in [action]?
• How do we expect customers will use the feature? For what purpose(s)?
• What reference material might a customer want/need to complete [action]?
• Is there source material that can be used as reference for the Technical Writer in writing the content? If yes, please link if available.
• What is the doc impact (New Content, Updates to existing content, or Release Note)?

References

• https://learn.microsoft.com/en-us/azure/aks/workload-identity-overview
• https://learn.microsoft.com/en-us/azure/active-directory/managed-identities-azure-resources/overview
• https://docs.microsoft.com/en-us/azure/active-directory/develop/workload-identity-federation
• https://docs.microsoft.com/en-us/azure/active-directory/develop/workload-identities-overview
• https://learn.microsoft.com/en-us/azure/aks/workload-identity-overview
• https://azure.github.io/azure-workload-identity/docs/introduction.html