OCPBUGS-44130: Add Azure permissions based on linked actions

[nrb]

Checked code in https://github.com/openshift/machine-api-provider-azure/tree/main/pkg and https://github.com/openshift/machine-api-operator for code aligning with these actions.

I was not able to find any mention of the properties listed in the provider JSON in either https://github.com/openshift/machine-api-provider-azure/ nor https://github.com/openshift/machine-api-operator.

The Machine API Operator itself does not appear reference any Azure calls directly, however Machine API Provider for Azure does.

Needed

Microsoft.Network/networkInterfaces/join/action
Microsoft.Network/networkSecurityGroups/join/action
Microsoft.Network/loadBalancers/backendAddressPools/join/action
Microsoft.Network/loadBalancers/frontendIPConfigurations/join/action
Microsoft.Network/publicIPAddresses/join/action
Microsoft.Network/virtualNetworks/subnets/join/action
Microsoft.Network/loadBalancers/inboundNatRules/join/action
Microsoft.Network/applicationSecurityGroups/joinNetworkSecurityRule/action
Microsoft.ManagedIdentity/userAssignedIdentities/assign/action

Likely

Microsoft.Compute/disks/beginGetAccess/action
    I don't see this explicitly mentioned in our disk management code, but it seems very likely that this is necessary

Not Needed

Microsoft.Network/publicIPPrefixes/join/action
    No mention of IP Prefixes found in our code
Microsoft.Network/ddosProtectionPlans/join/action
    No mention of DDOS Protection in our code
Microsoft.Network/loadBalancers/inboundNatPools/join/action
    No mention of NAT Pools found in our code
Microsoft.KeyVault/vaults/deploy/action
    No mention of vaults in our code
Microsoft.Network/applicationGateways/backendAddressPools/join/action
    No mention of application gateways in our code. However, NICs have mention of network.BackendAddressPools. These only seem to be added to load balancers.
Microsoft.Network/gatewayLoadBalancerAliases/join/action
    No mention of gateway load balancers or aliases in our code
Microsoft.Network/applicationSecurityGroups/joinNetworkSecurityRule/action
    No mention of network security rules within the application security group code; this may be a newer feature, since I don't even see a reference to network security rules for ASGs in the SDK
Microsoft.Network/applicationSecurityGroups/joinIpConfiguration/action
    No mention of IP configurations in our application security group code, though there are IP configurations for load balancers

[openshift-ci-robot]

@nrb: This pull request references Jira Issue OCPBUGS-44130, which is invalid:

• expected the bug to target the "4.18.0" version, but no target version was set

Comment /jira refresh to re-evaluate validity if changes to the Jira bug are made, or edit the title of this pull request to link to a different bug.

The bug has been updated to refer to the pull request using the external bug tracker.

In response to this:

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[nrb]

/test e2e-aws-operator

[openshift-ci]

@nrb: The following tests failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
ci/prow/e2e-vsphere-ovn-serial	574f5d4	link	false	/test e2e-vsphere-ovn-serial
ci/prow/e2e-vsphere-operator	574f5d4	link	false	/test e2e-vsphere-operator
ci/prow/e2e-gcp-ovn	574f5d4	link	false	/test e2e-gcp-ovn
ci/prow/e2e-metal-ipi-virtualmedia	574f5d4	link	false	/test e2e-metal-ipi-virtualmedia
ci/prow/e2e-vsphere-ovn	574f5d4	link	false	/test e2e-vsphere-ovn
ci/prow/okd-scos-e2e-aws-ovn	574f5d4	link	false	/test okd-scos-e2e-aws-ovn

Full PR test history. Your PR dashboard.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

[elmiko]

/approve
/lgtm

[openshift-ci]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: elmiko

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

• OWNERS [elmiko]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[JoelSpeed]

/hold

I asked in slack but should have commented here. There's currently no description or justification attached to this PR as to why we are adding these permissions. I'm worried we will lose the context unless we document it. Can we please explain how we reached the conclusion that these new permissions were required

[openshift-ci-robot]

@nrb: This pull request references Jira Issue OCPBUGS-44130, which is invalid:

• expected the bug to target the "4.19.0" version, but no target version was set

Comment /jira refresh to re-evaluate validity if changes to the Jira bug are made, or edit the title of this pull request to link to a different bug.

In response to this:

Checked code in https://github.com/openshift/machine-api-provider-azure/tree/main/pkg and https://github.com/openshift/machine-api-operator for code aligning with these actions.

I was not able to find any mention of the properties listed in the provider JSON in either https://github.com/openshift/machine-api-provider-azure/ nor https://github.com/openshift/machine-api-operator.

The Machine API Operator itself does not appear reference any Azure calls directly, however Machine API Provider for Azure does.

Needed

Microsoft.Network/networkInterfaces/join/action
Microsoft.Network/networkSecurityGroups/join/action
Microsoft.Network/loadBalancers/backendAddressPools/join/action
Microsoft.Network/loadBalancers/frontendIPConfigurations/join/action
Microsoft.Network/publicIPAddresses/join/action
Microsoft.Network/virtualNetworks/subnets/join/action
Microsoft.Network/loadBalancers/inboundNatRules/join/action
Microsoft.Network/applicationSecurityGroups/joinNetworkSecurityRule/action
Microsoft.ManagedIdentity/userAssignedIdentities/assign/action

Likely

Microsoft.Compute/disks/beginGetAccess/action
I don't see this explicitly mentioned in our disk management code, but it seems very likely that this is necessary

Not Needed

Microsoft.Network/publicIPPrefixes/join/action
No mention of IP Prefixes found in our code
Microsoft.Network/ddosProtectionPlans/join/action
No mention of DDOS Protection in our code
Microsoft.Network/loadBalancers/inboundNatPools/join/action
No mention of NAT Pools found in our code
Microsoft.KeyVault/vaults/deploy/action
No mention of vaults in our code
Microsoft.Network/applicationGateways/backendAddressPools/join/action
No mention of application gateways in our code. However, NICs have mention of network.BackendAddressPools. These only seem to be added to load balancers.
Microsoft.Network/gatewayLoadBalancerAliases/join/action
No mention of gateway load balancers or aliases in our code
Microsoft.Network/applicationSecurityGroups/joinNetworkSecurityRule/action
No mention of network security rules within the application security group code; this may be a newer feature, since I don't even see a reference to network security rules for ASGs in the SDK
Microsoft.Network/applicationSecurityGroups/joinIpConfiguration/action
No mention of IP configurations in our application security group code, though there are IP configurations for load balancers

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[nrb]

@JoelSpeed Added description from Jira issue; is that sufficient?

[JoelSpeed]

/hold cancel

Thanks, works for me

[JoelSpeed]

/retest-required