Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Skip service principal enrichment for MIWI clusters #3971

Merged
merged 1 commit into from
Nov 22, 2024

Conversation

kimorris27
Copy link
Contributor

Which issue this PR addresses:

https://issues.redhat.com/browse/ARO-11680

What this PR does / why we need it:

This PR modifies cluster enrichment such that the service principal enricher is skipped for MIWI clusters. I didn't add any additional MIWI-specific enrichment because it's not necessary; unlike in the service principal case, MIWI identities/federated credentials can't be rotated without going through the RP.

Test plan for issue:

  1. Ran az aro list against local dev RP and observed an error saying that the SP enricher failed
  2. Made code changes and restarted dev RP
  3. Ran az aro list again and observed the error was no longer present, meaning SP enrichment had been skipped

Is there any documentation that needs to be updated for this PR?

N/A

How do you know this will function as expected in production?

E2E

@kimorris27
Copy link
Contributor Author

/azp run ci, e2e

Copy link

Azure Pipelines successfully started running 2 pipeline(s).

@kimorris27
Copy link
Contributor Author

/azp run ci

Copy link

Azure Pipelines successfully started running 1 pipeline(s).

@kimorris27
Copy link
Contributor Author

/azp run ci

Copy link

Azure Pipelines successfully started running 1 pipeline(s).

@kimorris27
Copy link
Contributor Author

/azp run ci

Copy link

Azure Pipelines successfully started running 1 pipeline(s).

Copy link
Collaborator

@tsatam tsatam left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Implementation looks good to me as-is, but I'm curious if we want to consider a simpler approach where we just make the service principal enricher exit early if the cluster is a MIWI cluster, and not have to worry about maintaining the list and number of enrichers differently for CSP vs MIWI clusters: https://github.com/Azure/ARO-RP/blob/master/pkg/util/clusterdata/service_principal.go

@kimorris27
Copy link
Contributor Author

Implementation looks good to me as-is, but I'm curious if we want to consider a simpler approach where we just make the service principal enricher exit early if the cluster is a MIWI cluster, and not have to worry about maintaining the list and number of enrichers differently for CSP vs MIWI clusters: https://github.com/Azure/ARO-RP/blob/master/pkg/util/clusterdata/service_principal.go

I'll go ahead and merge it as-is. It's true that that implementation would be a bit simpler in some sense, but we'd find ourselves either 1) emitting metrics for an enricher we're not running or 2) adding the same special handling around metric emission that I already added.

@kimorris27 kimorris27 merged commit 0b3dc3b into master Nov 22, 2024
19 checks passed
@tsatam
Copy link
Collaborator

tsatam commented Nov 22, 2024

Implementation looks good to me as-is, but I'm curious if we want to consider a simpler approach where we just make the service principal enricher exit early if the cluster is a MIWI cluster, and not have to worry about maintaining the list and number of enrichers differently for CSP vs MIWI clusters: https://github.com/Azure/ARO-RP/blob/master/pkg/util/clusterdata/service_principal.go

I'll go ahead and merge it as-is. It's true that that implementation would be a bit simpler in some sense, but we'd find ourselves either 1) emitting metrics for an enricher we're not running or 2) adding the same special handling around metric emission that I already added.

true, good point. Happy to keep the current implementation as-is then.

@kimorris27 kimorris27 deleted the kimorris27/ARO-11680-miwi-cluster-enrichment branch November 22, 2024 14:48
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
chainsaw Pull requests or issues owned by Team Chainsaw ready-for-review
Projects
None yet
Development

Successfully merging this pull request may close these issues.

4 participants