Feature Overview (aka. Goal Summary)  

Customers need the ability to reduce the security impact of a public keyvault storing encryption keys (etcd). Azure provides a few ways to secure the keyvault (making it private and attaching it to the vnet) however, the control plane of the customer run in the Azure tenant and is not able to be attached to the same subnet/load balancer as the workers.
Azure keyvault provides Azure services the ability to claim that these services are trusted by validating that the interaction from the keyvaul is indeed coming from a trusted source.

This feature will enable ARO HCP to be a trusted service for etcd encryption. This will enable an additional security layer so that no entity has the ability to get to the encryption keys.

Documentation:
https://eng.ms/docs/products/arm/rbac/managed_identities/msionboardingtrustedmicrosoftservices

https://docs.google.com/document/d/1YSazcfvTZaTXymbPGFNz5vngW-YTK67hZdbBjhyvmD0/edit?tab=t.0

Goals (aka. expected user outcomes)

By doing this work, a customer can be ensured that only a trusted Azure service (ARO in this case) would be able to communicate with Azure keyvault. Complete during New status.

<your text here>

Requirements (aka. Acceptance Criteria):

A list of specific needs or objectives that a feature must deliver in order to be considered complete.  Be sure to include nonfunctional requirements such as security, reliability, performance, maintainability, scalability, usability, etc.  Initial completion during Refinement status.

<enter general Feature acceptance here>

Anyone reviewing this Feature needs to know which deployment configurations that the Feature will apply to (or not) once it's been completed.  Describe specific needs (or indicate N/A) for each of the following deployment scenarios. For specific configurations that are out-of-scope for a given release, ensure you provide the OCPSTRAT (for the future to be supported configuration) as well.

Use Cases (Optional):

Include use case diagrams, main success scenarios, alternative flow scenarios.  Initial completion during Refinement status.

<your text here>

Questions to Answer (Optional):

Include a list of refinement / architectural questions that may need to be answered before coding can begin.  Initial completion during Refinement status.

<your text here>

Out of Scope

High-level list of items that are out of scope.  Initial completion during Refinement status.

<your text here>

Background

Provide any additional context is needed to frame the feature.  Initial completion during Refinement status.

<your text here>

Customer Considerations

Provide any additional customer-specific considerations that must be made when designing and delivering the Feature.  Initial completion during Refinement status.

<your text here>

Documentation Considerations

Provide information that needs to be considered and planned so that documentation will meet customer needs.  If the feature extends existing functionality, provide a link to its current documentation. Initial completion during Refinement status.

<your text here>

Interoperability Considerations

Which other projects, including ROSA/OSD/ARO, and versions in our portfolio does this feature impact?  What interoperability test scenarios should be factored by the layered products?  Initial completion during Refinement status.

<your text here>