HOSTEDCP-2193: documenting --managed-identities-file flag #5199

Patryk-Stefanski · 2024-11-28T14:06:18Z

What this PR does / why we need it:

Which issue(s) this PR fixes (optional, use fixes #<issue_number>(, fixes #<issue_number>, ...) format, where issue_number might be a GitHub issue, or a Jira story:
Fixes #

Checklist

Subject and description added to both, commit and PR.
Relevant issues have been referenced.
This change includes docs.
This change includes unit tests.

openshift-ci-robot · 2024-11-28T14:06:58Z

@Patryk-Stefanski: This pull request references HOSTEDCP-2193 which is a valid jira issue.

Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the task to target the "4.19.0" version, but no target version was set.

In response to this:

What this PR does / why we need it:

Which issue(s) this PR fixes (optional, use fixes #<issue_number>(, fixes #<issue_number>, ...) format, where issue_number might be a GitHub issue, or a Jira story:
Fixes #

Checklist

Subject and description added to both, commit and PR.

Relevant issues have been referenced.

This change includes docs.

This change includes unit tests.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

enxebre · 2024-11-28T15:18:51Z

/lgtm

enxebre · 2024-11-28T15:19:22Z

/hold

Patryk-Stefanski · 2024-11-28T16:26:38Z

Waiting to merge this once the old SP logic is cleaned up and the new one is fully implemented and live in our e2es

bryan-cox · 2024-12-02T13:46:25Z

docs/content/how-to/azure/create-azure-cluster-with-options.md

+OUTPUT_FILE="service-principals.json"
+
+cat <<EOF > SP_FILE
+{


Should this have the control plane vs data plane distinction? Are you planning to reuse this file for workload identity for the managed identities on the data plane side?

yep we will use one file for all the managed-identities we will have to pass in

bryan-cox · 2024-12-02T13:48:11Z

docs/content/how-to/azure/create-azure-cluster-with-options.md

+    },
+    "managedIdentitiesKeyVault": {
+        "name": "${KV_NAME}",
+        "tenantID": "$(az account show --query tenantId -o tsv)"


Maybe this should just be predefined above. Maybe the MI KV can be in a different tenant than the use running this.

bryan-cox · 2024-12-05T13:14:05Z

contrib/managed-azure/setup_dev_environment.md

+
+## Steps
+Note: Steps 1-7 set up the environment so that if created in a persistent group they can be 
+reused for creation of clusters in the future.


Maybe the why should be added here, i.e. quota issues.

openshift-ci · 2024-12-05T15:48:05Z

@Patryk-Stefanski: The following test failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
ci/prow/e2e-aks	`14424d3`	link	true	`/test e2e-aks`

Full PR test history. Your PR dashboard.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

bryan-cox · 2024-12-05T15:50:33Z

contrib/managed-azure/create_basic_hosted_cluster.sh

@@ -4,6 +4,10 @@ set -x
 # This creates an Azure HostedCluster with the VNET in its own RG and the NSG in its own NSG.
 # The MANAGED_RG_NAME contains all the cloud resources created by the HC creation.

+# Prerequisites:
+# 1. File with control plane managed identities in json format, see steps 5 & 6 in setup_dev_environment.md


nit

Suggested change

# 1. File with control plane managed identities in json format, see steps 5 & 6 in setup_dev_environment.md

# 1. JSON file containing control plane service principals, see steps 5 & 6 in setup_dev_environment.md

bryan-cox · 2024-12-05T15:55:19Z

contrib/managed-azure/setup_dev_environment.md

+DNS_RECORD_NAME=<DNS_RECORD_NAME>
+EXTERNAL_DNS_SP_NAME=<EXTERNAL_DNS_SP_NAME>
+EXTERNAL_DNS_CREDS=<PATH_TO_FILE_WITH_DNS_CREDS>
+DNS_ZONE_NAME="<DNS_RECORD_NAME>.hypershift.azure.devcluster.openshift.com"


Should this block and the two below be generic and not point to our actual resources?

adding note to that these are meant for hypershift engineers and that attention should be paid when using these

bryan-cox · 2024-12-05T15:57:41Z

contrib/managed-azure/setup_dev_environment.md

+### 5. Create Service Principals
+
+```sh
+cloudProvider=$(az ad sp create-for-rbac --name "${CLOUD_PROVIDER_SP_NAME}" --create-cert --cert "${CLOUD_PROVIDER_SP_NAME}" --keyvault "${KV_NAME}" --query "{clientID: appId, certificateName: '${CLOUD_PROVIDER_SP_NAME}'}" -o json)


Just double checking, this automatically gets filled out correctly?

bryan-cox · 2024-12-09T17:42:43Z

/hold cancel
/approve

openshift-ci · 2024-12-09T17:43:00Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: bryan-cox, Patryk-Stefanski

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

~~OWNERS~~ [bryan-cox]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

sjenning · 2024-12-10T15:09:07Z

/lgtm

openshift-bot · 2024-12-10T22:52:39Z

[ART PR BUILD NOTIFIER]

Distgit: hypershift
This PR has been included in build ose-hypershift-container-v4.19.0-202412102006.p0.g0102cde.assembly.stream.el9.
All builds following this will include this PR.

openshift-ci bot added the do-not-merge/needs-area label Nov 28, 2024

openshift-ci bot requested review from hasueki and sjenning November 28, 2024 14:06

openshift-ci bot added area/cli Indicates the PR includes changes for CLI area/documentation Indicates the PR includes changes for documentation area/testing Indicates the PR includes changes for e2e testing and removed do-not-merge/needs-area labels Nov 28, 2024

Patryk-Stefanski changed the title ~~Hostedcp 2193 documentation~~ HOSTEDCP-2193: documenting --managed-identities-file flag Nov 28, 2024

openshift-ci-robot added the jira/valid-reference Indicates that this PR references a valid Jira ticket of any type. label Nov 28, 2024

Patryk-Stefanski force-pushed the HOSTEDCP-2193-documentation branch from 1839f15 to 14424d3 Compare November 28, 2024 14:12

openshift-ci bot assigned enxebre Nov 28, 2024

openshift-ci bot added the lgtm Indicates that a PR is ready to be merged. label Nov 28, 2024

openshift-ci bot added the do-not-merge/hold Indicates that a PR should not merge because someone has issued a /hold command. label Nov 28, 2024

bryan-cox reviewed Dec 2, 2024

View reviewed changes

Patryk-Stefanski force-pushed the HOSTEDCP-2193-documentation branch from 14424d3 to aa302b9 Compare December 5, 2024 12:02

openshift-ci bot removed the lgtm Indicates that a PR is ready to be merged. label Dec 5, 2024

Patryk-Stefanski force-pushed the HOSTEDCP-2193-documentation branch from aa302b9 to 2c5e6d3 Compare December 5, 2024 13:01

bryan-cox reviewed Dec 5, 2024

View reviewed changes

HOSTEDCP-2193: documenting --managed-identities-file flag

14c88b7

Patryk-Stefanski force-pushed the HOSTEDCP-2193-documentation branch from 2c5e6d3 to 14c88b7 Compare December 5, 2024 16:28

openshift-ci bot removed the do-not-merge/hold Indicates that a PR should not merge because someone has issued a /hold command. label Dec 9, 2024

openshift-ci bot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Dec 9, 2024

openshift-ci bot assigned sjenning Dec 10, 2024

openshift-ci bot added the lgtm Indicates that a PR is ready to be merged. label Dec 10, 2024

openshift-merge-bot bot merged commit 0102cde into openshift:main Dec 10, 2024
4 checks passed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

HOSTEDCP-2193: documenting --managed-identities-file flag #5199

HOSTEDCP-2193: documenting --managed-identities-file flag #5199

Patryk-Stefanski commented Nov 28, 2024

openshift-ci-robot commented Nov 28, 2024 •

edited by openshift-ci bot

Loading

enxebre commented Nov 28, 2024

enxebre commented Nov 28, 2024

Patryk-Stefanski commented Nov 28, 2024

bryan-cox Dec 2, 2024

Patryk-Stefanski Dec 5, 2024

bryan-cox Dec 2, 2024

bryan-cox Dec 5, 2024

openshift-ci bot commented Dec 5, 2024 •

edited

Loading

bryan-cox Dec 5, 2024

bryan-cox Dec 5, 2024

Patryk-Stefanski Dec 5, 2024

bryan-cox Dec 5, 2024

Patryk-Stefanski Dec 5, 2024

bryan-cox commented Dec 9, 2024

openshift-ci bot commented Dec 9, 2024

sjenning commented Dec 10, 2024

openshift-bot commented Dec 10, 2024

	# 1. File with control plane managed identities in json format, see steps 5 & 6 in setup_dev_environment.md
	# 1. JSON file containing control plane service principals, see steps 5 & 6 in setup_dev_environment.md

HOSTEDCP-2193: documenting --managed-identities-file flag #5199

HOSTEDCP-2193: documenting --managed-identities-file flag #5199

Conversation

Patryk-Stefanski commented Nov 28, 2024

openshift-ci-robot commented Nov 28, 2024 • edited by openshift-ci bot Loading

enxebre commented Nov 28, 2024

enxebre commented Nov 28, 2024

Patryk-Stefanski commented Nov 28, 2024

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

openshift-ci bot commented Dec 5, 2024 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

bryan-cox commented Dec 9, 2024

openshift-ci bot commented Dec 9, 2024

sjenning commented Dec 10, 2024

openshift-bot commented Dec 10, 2024

openshift-ci-robot commented Nov 28, 2024 •

edited by openshift-ci bot

Loading

openshift-ci bot commented Dec 5, 2024 •

edited

Loading