Merge pull request #5932 from nojnhuh/vm-identity-prefix

[release-1.21] Fix mishandling of azure:// prefix on AzureMachine UserAssignedIdentities

Author: k8s-ci-robot

azure/services/virtualmachines/virtualmachines.go

@@ -171,7 +171,7 @@ func (s *Service) checkUserAssignedIdentities(specIdentities []infrav1.UserAssig
 
 	// Check if the expected identities are present in the vm.
 	for _, expectedIdentity := range specIdentities {
-		_, exists := actualMap[expectedIdentity.ProviderID]
+		_, exists := actualMap[strings.TrimPrefix(expectedIdentity.ProviderID, azureutil.ProviderIDPrefix)]
 		if !exists {
 			s.Scope.SetConditionFalse(infrav1.VMIdentitiesReadyCondition, infrav1.UserAssignedIdentityMissingReason, clusterv1.ConditionSeverityWarning, vmMissingUAI+expectedIdentity.ProviderID)
 			return

azure/services/virtualmachines/virtualmachines_test.go

@@ -37,6 +37,7 @@ import (
 	"sigs.k8s.io/cluster-api-provider-azure/azure/services/publicips"
 	"sigs.k8s.io/cluster-api-provider-azure/azure/services/virtualmachines/mock_virtualmachines"
 	gomockinternal "sigs.k8s.io/cluster-api-provider-azure/internal/test/matchers/gomock"
+	azureutil "sigs.k8s.io/cluster-api-provider-azure/util/azure"
 	"sigs.k8s.io/cluster-api-provider-azure/util/reconciler"
 )
 
@@ -112,10 +113,16 @@ var (
 		},
 	}
 	fakeUserAssignedIdentity = infrav1.UserAssignedIdentity{
-		ProviderID: "azure:///subscriptions/123/resourceGroups/test-rg/providers/Microsoft.ManagedIdentity/userAssignedIdentities/fake-provider-id",
+		ProviderID: "/subscriptions/123/resourceGroups/test-rg/providers/Microsoft.ManagedIdentity/userAssignedIdentities/fake-provider-id",
+	}
+	fakeUserAssignedIdentityWithPrefix = infrav1.UserAssignedIdentity{
+		ProviderID: azureutil.ProviderIDPrefix + fakeUserAssignedIdentity.ProviderID,
 	}
 	fakeUserAssignedIdentity2 = infrav1.UserAssignedIdentity{
-		ProviderID: "azure:///subscriptions/123/resourceGroups/test-rg/providers/Microsoft.ManagedIdentity/userAssignedIdentities/fake-provider-id-2",
+		ProviderID: fakeUserAssignedIdentity.ProviderID + "-2",
+	}
+	fakeUserAssignedIdentity2WithPrefix = infrav1.UserAssignedIdentity{
+		ProviderID: azureutil.ProviderIDPrefix + fakeUserAssignedIdentity2.ProviderID,
 	}
 )
 
@@ -323,14 +330,14 @@ func TestCheckUserAssignedIdentities(t *testing.T) {
 		},
 		{
 			name:             "matching user assigned identities",
-			specIdentities:   []infrav1.UserAssignedIdentity{fakeUserAssignedIdentity},
+			specIdentities:   []infrav1.UserAssignedIdentity{fakeUserAssignedIdentityWithPrefix},
 			actualIdentities: []infrav1.UserAssignedIdentity{fakeUserAssignedIdentity},
 		},
 		{
 			name:             "less user assigned identities than expected",
-			specIdentities:   []infrav1.UserAssignedIdentity{fakeUserAssignedIdentity, fakeUserAssignedIdentity2},
+			specIdentities:   []infrav1.UserAssignedIdentity{fakeUserAssignedIdentity, fakeUserAssignedIdentity2WithPrefix},
 			actualIdentities: []infrav1.UserAssignedIdentity{fakeUserAssignedIdentity},
-			expectedKey:      fakeUserAssignedIdentity2.ProviderID,
+			expectedKey:      fakeUserAssignedIdentity2WithPrefix.ProviderID,
 		},
 		{
 			name:             "more user assigned identities than expected",

docs/book/src/topics/workload-identity.md

@@ -142,7 +142,7 @@ to give the identity Contributor access to the Azure subscription where the work
   ```yaml
   identity: UserAssigned
   userAssignedIdentities:
-  - providerID: /subscriptions/${AZURE_SUBSCRIPTION_ID}/resourceGroups/${RESOURCE_GROUP}/providers/Microsoft.ManagedIdentity/userAssignedIdentities/${USER_ASSIGNED_IDENTITY_NAME}
+  - providerID: azure:///subscriptions/${AZURE_SUBSCRIPTION_ID}/resourceGroups/${RESOURCE_GROUP}/providers/Microsoft.ManagedIdentity/userAssignedIdentities/${USER_ASSIGNED_IDENTITY_NAME}
   ```
 
   A sample `AzureMachineTemplate` after the edit should look like the below:
@@ -162,7 +162,7 @@ to give the identity Contributor access to the Azure subscription where the work
         sshPublicKey: ${AZURE_SSH_PUBLIC_KEY_B64:=""}
         identity: UserAssigned
         userAssignedIdentities:
-        - providerID: /subscriptions/${AZURE_SUBSCRIPTION_ID}/resourceGroups/${RESOURCE_GROUP}/providers/Microsoft.ManagedIdentity/userAssignedIdentities/${USER_ASSIGNED_IDENTITY_NAME}
+        - providerID: azure:///subscriptions/${AZURE_SUBSCRIPTION_ID}/resourceGroups/${RESOURCE_GROUP}/providers/Microsoft.ManagedIdentity/userAssignedIdentities/${USER_ASSIGNED_IDENTITY_NAME}
         vmSize: ${AZURE_NODE_MACHINE_TYPE}
   ```