-
Notifications
You must be signed in to change notification settings - Fork 171
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Skip service principal enrichment for MIWI clusters #3971
Skip service principal enrichment for MIWI clusters #3971
Conversation
/azp run ci, e2e |
Azure Pipelines successfully started running 2 pipeline(s). |
/azp run ci |
Azure Pipelines successfully started running 1 pipeline(s). |
/azp run ci |
Azure Pipelines successfully started running 1 pipeline(s). |
/azp run ci |
Azure Pipelines successfully started running 1 pipeline(s). |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Implementation looks good to me as-is, but I'm curious if we want to consider a simpler approach where we just make the service principal enricher exit early if the cluster is a MIWI cluster, and not have to worry about maintaining the list and number of enrichers differently for CSP vs MIWI clusters: https://github.com/Azure/ARO-RP/blob/master/pkg/util/clusterdata/service_principal.go
I'll go ahead and merge it as-is. It's true that that implementation would be a bit simpler in some sense, but we'd find ourselves either 1) emitting metrics for an enricher we're not running or 2) adding the same special handling around metric emission that I already added. |
true, good point. Happy to keep the current implementation as-is then. |
Which issue this PR addresses:
https://issues.redhat.com/browse/ARO-11680
What this PR does / why we need it:
This PR modifies cluster enrichment such that the service principal enricher is skipped for MIWI clusters. I didn't add any additional MIWI-specific enrichment because it's not necessary; unlike in the service principal case, MIWI identities/federated credentials can't be rotated without going through the RP.
Test plan for issue:
az aro list
against local dev RP and observed an error saying that the SP enricher failedaz aro list
again and observed the error was no longer present, meaning SP enrichment had been skippedIs there any documentation that needs to be updated for this PR?
N/A
How do you know this will function as expected in production?
E2E