Skip to content

CORS-3931: [azure] add more permission when installing cluster in existing vnet #61374

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
openshift-merge-bot merged 1 commit into from
Feb 25, 2025
Merged

CORS-3931: [azure] add more permission when installing cluster in existing vnet #61374

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
5 changes: 2 additions & 3 deletions ci-operator/config/openshift-priv/installer/openshift-priv-installer-main.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -553,9 +553,9 @@ tests:
post:
- chain: ipi-azure-post
pre:
- ref: azure-provision-service-principal-minimal-permission
- ref: ipi-conf
- ref: ipi-conf-azure-default
- chain: azure-provision-service-principal-minimal-permission
Copy link
Member

@liangxia liangxia Feb 25, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Do we really want to change openshift-priv ones ?

Copy link
Contributor Author

@jinyunma jinyunma Feb 25, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Are those openshift-priv jobs automatically synced up by some way? I searched them when updating this chain.
I'm not sure when this job will be triggered. Once triggered, the change is needed here.

Copy link
Contributor

@jianlinliu jianlinliu Feb 25, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yeah, we updated the openshift-priv ones on purpose because of mini-perm change.

Copy link
Member

@liangxia liangxia Feb 25, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

AFAIK, those openshift-priv are used by ART team. Generally we don't touch them as there are auto sync mechanism.
If you are sure this is exactly needed, I can approve it. Just let me know.

Copy link
Contributor Author

@jinyunma jinyunma Feb 25, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

got it, the change is required regardless in which way to update them.
Thanks for approving this.

Copy link
Contributor Author

@jinyunma jinyunma Feb 25, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@liangxia I removed the change in openshift-priv job config, PTAL.

Copy link
Contributor Author

@jinyunma jinyunma Feb 25, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

seems that the change must be done manually in this PR for openshift-priv jobs, otherwise job pull-ci-openshift-release-master-ci-operator-config failed, because some envs are removed on purpose in this PR.

So I changed back for openshift-priv jobs.

- chain: ipi-install
timeout: 6h0m0s
- as: e2e-azure-ovn
Expand Down Expand Up @@ -1159,7 +1159,6 @@ tests:
cluster_profile: azure4
env:
AZURE_INSTALL_USE_MINIMAL_PERMISSIONS: "yes"
ENABLE_MIN_PERMISSION_FOR_MARKETPLACE: "true"
FAIL_ON_CORE_DUMP: "false"
OS_IMAGE_PLAN: NoPurchasePlan
OS_IMAGE_URN: azureopenshift:aro4:aro_417:417.94.20240701
Expand All @@ -1169,10 +1168,10 @@ tests:
- chain: ipi-deprovision
- ref: azure-deprovision-sp-and-custom-role
pre:
- ref: azure-provision-service-principal-minimal-permission
- chain: ipi-conf-azure
- ref: ipi-conf-azure-osimage
- ref: ovn-conf
- chain: azure-provision-service-principal-minimal-permission
- chain: ipi-install
- ref: ipi-azure-rbac
timeout: 6h0m0s
Expand Down
5 changes: 2 additions & 3 deletions ci-operator/config/openshift-priv/installer/openshift-priv-installer-release-4.18.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -559,9 +559,9 @@ tests:
post:
- chain: ipi-azure-post
pre:
- ref: azure-provision-service-principal-minimal-permission
- ref: ipi-conf
- ref: ipi-conf-azure-default
- chain: azure-provision-service-principal-minimal-permission
- chain: ipi-install
timeout: 6h0m0s
- as: e2e-azure-ovn
Expand Down Expand Up @@ -1155,7 +1155,6 @@ tests:
cluster_profile: azure4
env:
AZURE_INSTALL_USE_MINIMAL_PERMISSIONS: "yes"
ENABLE_MIN_PERMISSION_FOR_MARKETPLACE: "true"
FAIL_ON_CORE_DUMP: "false"
OS_IMAGE_PLAN: NoPurchasePlan
OS_IMAGE_URN: azureopenshift:aro4:aro_417:417.94.20240701
Expand All @@ -1165,10 +1164,10 @@ tests:
- chain: ipi-deprovision
- ref: azure-deprovision-sp-and-custom-role
pre:
- ref: azure-provision-service-principal-minimal-permission
- chain: ipi-conf-azure
- ref: ipi-conf-azure-osimage
- ref: ovn-conf
- chain: azure-provision-service-principal-minimal-permission
- chain: ipi-install
- ref: ipi-azure-rbac
timeout: 6h0m0s
Expand Down
5 changes: 2 additions & 3 deletions ci-operator/config/openshift-priv/installer/openshift-priv-installer-release-4.19.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -554,9 +554,9 @@ tests:
post:
- chain: ipi-azure-post
pre:
- ref: azure-provision-service-principal-minimal-permission
- ref: ipi-conf
- ref: ipi-conf-azure-default
- chain: azure-provision-service-principal-minimal-permission
- chain: ipi-install
timeout: 6h0m0s
- as: e2e-azure-ovn
Expand Down Expand Up @@ -1160,7 +1160,6 @@ tests:
cluster_profile: azure4
env:
AZURE_INSTALL_USE_MINIMAL_PERMISSIONS: "yes"
ENABLE_MIN_PERMISSION_FOR_MARKETPLACE: "true"
FAIL_ON_CORE_DUMP: "false"
OS_IMAGE_PLAN: NoPurchasePlan
OS_IMAGE_URN: azureopenshift:aro4:aro_417:417.94.20240701
Expand All @@ -1170,10 +1169,10 @@ tests:
- chain: ipi-deprovision
- ref: azure-deprovision-sp-and-custom-role
pre:
- ref: azure-provision-service-principal-minimal-permission
- chain: ipi-conf-azure
- ref: ipi-conf-azure-osimage
- ref: ovn-conf
- chain: azure-provision-service-principal-minimal-permission
- chain: ipi-install
- ref: ipi-azure-rbac
timeout: 6h0m0s
Expand Down
5 changes: 2 additions & 3 deletions ci-operator/config/openshift-priv/installer/openshift-priv-installer-release-4.20.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -553,9 +553,9 @@ tests:
post:
- chain: ipi-azure-post
pre:
- ref: azure-provision-service-principal-minimal-permission
- ref: ipi-conf
- ref: ipi-conf-azure-default
- chain: azure-provision-service-principal-minimal-permission
- chain: ipi-install
timeout: 6h0m0s
- as: e2e-azure-ovn
Expand Down Expand Up @@ -1159,7 +1159,6 @@ tests:
cluster_profile: azure4
env:
AZURE_INSTALL_USE_MINIMAL_PERMISSIONS: "yes"
ENABLE_MIN_PERMISSION_FOR_MARKETPLACE: "true"
FAIL_ON_CORE_DUMP: "false"
OS_IMAGE_PLAN: NoPurchasePlan
OS_IMAGE_URN: azureopenshift:aro4:aro_417:417.94.20240701
Expand All @@ -1169,10 +1168,10 @@ tests:
- chain: ipi-deprovision
- ref: azure-deprovision-sp-and-custom-role
pre:
- ref: azure-provision-service-principal-minimal-permission
- chain: ipi-conf-azure
- ref: ipi-conf-azure-osimage
- ref: ovn-conf
- chain: azure-provision-service-principal-minimal-permission
- chain: ipi-install
- ref: ipi-azure-rbac
timeout: 6h0m0s
Expand Down
5 changes: 2 additions & 3 deletions ci-operator/config/openshift/installer/openshift-installer-main.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -552,9 +552,9 @@ tests:
post:
- chain: ipi-azure-post
pre:
- ref: azure-provision-service-principal-minimal-permission
- ref: ipi-conf
- ref: ipi-conf-azure-default
- chain: azure-provision-service-principal-minimal-permission
- chain: ipi-install
timeout: 6h0m0s
- as: e2e-azure-ovn
Expand Down Expand Up @@ -1158,7 +1158,6 @@ tests:
cluster_profile: azure4
env:
AZURE_INSTALL_USE_MINIMAL_PERMISSIONS: "yes"
ENABLE_MIN_PERMISSION_FOR_MARKETPLACE: "true"
FAIL_ON_CORE_DUMP: "false"
OS_IMAGE_PLAN: NoPurchasePlan
OS_IMAGE_URN: azureopenshift:aro4:aro_417:417.94.20240701
Expand All @@ -1168,10 +1167,10 @@ tests:
- chain: ipi-deprovision
- ref: azure-deprovision-sp-and-custom-role
pre:
- ref: azure-provision-service-principal-minimal-permission
- chain: ipi-conf-azure
- ref: ipi-conf-azure-osimage
- ref: ovn-conf
- chain: azure-provision-service-principal-minimal-permission
- chain: ipi-install
- ref: ipi-azure-rbac
timeout: 6h0m0s
Expand Down
5 changes: 2 additions & 3 deletions ci-operator/config/openshift/installer/openshift-installer-release-4.18.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -558,9 +558,9 @@ tests:
post:
- chain: ipi-azure-post
pre:
- ref: azure-provision-service-principal-minimal-permission
- ref: ipi-conf
- ref: ipi-conf-azure-default
- chain: azure-provision-service-principal-minimal-permission
- chain: ipi-install
timeout: 6h0m0s
- as: e2e-azure-ovn
Expand Down Expand Up @@ -1154,7 +1154,6 @@ tests:
cluster_profile: azure4
env:
AZURE_INSTALL_USE_MINIMAL_PERMISSIONS: "yes"
ENABLE_MIN_PERMISSION_FOR_MARKETPLACE: "true"
FAIL_ON_CORE_DUMP: "false"
OS_IMAGE_PLAN: NoPurchasePlan
OS_IMAGE_URN: azureopenshift:aro4:aro_417:417.94.20240701
Expand All @@ -1164,10 +1163,10 @@ tests:
- chain: ipi-deprovision
- ref: azure-deprovision-sp-and-custom-role
pre:
- ref: azure-provision-service-principal-minimal-permission
- chain: ipi-conf-azure
- ref: ipi-conf-azure-osimage
- ref: ovn-conf
- chain: azure-provision-service-principal-minimal-permission
- chain: ipi-install
- ref: ipi-azure-rbac
timeout: 6h0m0s
Expand Down
5 changes: 2 additions & 3 deletions ci-operator/config/openshift/installer/openshift-installer-release-4.19.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -553,9 +553,9 @@ tests:
post:
- chain: ipi-azure-post
pre:
- ref: azure-provision-service-principal-minimal-permission
- ref: ipi-conf
- ref: ipi-conf-azure-default
- chain: azure-provision-service-principal-minimal-permission
- chain: ipi-install
timeout: 6h0m0s
- as: e2e-azure-ovn
Expand Down Expand Up @@ -1159,7 +1159,6 @@ tests:
cluster_profile: azure4
env:
AZURE_INSTALL_USE_MINIMAL_PERMISSIONS: "yes"
ENABLE_MIN_PERMISSION_FOR_MARKETPLACE: "true"
FAIL_ON_CORE_DUMP: "false"
OS_IMAGE_PLAN: NoPurchasePlan
OS_IMAGE_URN: azureopenshift:aro4:aro_417:417.94.20240701
Expand All @@ -1169,10 +1168,10 @@ tests:
- chain: ipi-deprovision
- ref: azure-deprovision-sp-and-custom-role
pre:
- ref: azure-provision-service-principal-minimal-permission
- chain: ipi-conf-azure
- ref: ipi-conf-azure-osimage
- ref: ovn-conf
- chain: azure-provision-service-principal-minimal-permission
- chain: ipi-install
- ref: ipi-azure-rbac
timeout: 6h0m0s
Expand Down
5 changes: 2 additions & 3 deletions ci-operator/config/openshift/installer/openshift-installer-release-4.20.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -552,7 +552,7 @@ tests:
post:
- chain: ipi-azure-post
pre:
- ref: azure-provision-service-principal-minimal-permission
- chain: azure-provision-service-principal-minimal-permission
- ref: ipi-conf
- ref: ipi-conf-azure-default
- chain: ipi-install
Expand Down Expand Up @@ -1158,7 +1158,6 @@ tests:
cluster_profile: azure4
env:
AZURE_INSTALL_USE_MINIMAL_PERMISSIONS: "yes"
ENABLE_MIN_PERMISSION_FOR_MARKETPLACE: "true"
FAIL_ON_CORE_DUMP: "false"
OS_IMAGE_PLAN: NoPurchasePlan
OS_IMAGE_URN: azureopenshift:aro4:aro_417:417.94.20240701
Expand All @@ -1168,7 +1167,7 @@ tests:
- chain: ipi-deprovision
- ref: azure-deprovision-sp-and-custom-role
pre:
- ref: azure-provision-service-principal-minimal-permission
- chain: azure-provision-service-principal-minimal-permission
- chain: ipi-conf-azure
- ref: ipi-conf-azure-osimage
- ref: ovn-conf
Expand Down
4 changes: 2 additions & 2 deletions ...penshift-tests-private/openshift-openshift-tests-private-release-4.12__amd64-nightly.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1083,7 +1083,7 @@ tests:
steps:
cluster_profile: azure-qe
env:
AZURE_INSTALL_USE_MINIMAL_PERMISSIONS: "true"
AZURE_INSTALL_USE_MINIMAL_PERMISSIONS: "yes"
BASE_DOMAIN: qe.azure.devcluster.openshift.com
test:
- chain: openshift-e2e-test-qe-destructive
Expand All @@ -1093,7 +1093,7 @@ tests:
steps:
cluster_profile: azure-qe
env:
AZURE_INSTALL_USE_MINIMAL_PERMISSIONS: "true"
AZURE_INSTALL_USE_MINIMAL_PERMISSIONS: "yes"
BASE_DOMAIN: qe.azure.devcluster.openshift.com
test:
- chain: openshift-e2e-test-qe
Expand Down
2 changes: 1 addition & 1 deletion ...t-tests-private-release-4.12__automated-release-stable-4.12-upgrade-from-stable-4.12.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -73,7 +73,7 @@ tests:
allow_skip_on_success: true
cluster_profile: azure-autorelease-qe
env:
AZURE_INSTALL_USE_MINIMAL_PERMISSIONS: "true"
AZURE_INSTALL_USE_MINIMAL_PERMISSIONS: "yes"
BASE_DOMAIN: qe.azure.devcluster.openshift.com
FIPS_ENABLED: "true"
test:
Expand Down
2 changes: 1 addition & 1 deletion ...hift-tests-private/openshift-openshift-tests-private-release-4.12__automated-release.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -89,7 +89,7 @@ tests:
allow_skip_on_success: true
cluster_profile: azure-autorelease-qe
env:
AZURE_INSTALL_USE_MINIMAL_PERMISSIONS: "true"
AZURE_INSTALL_USE_MINIMAL_PERMISSIONS: "yes"
BASE_DOMAIN: qe.azure.devcluster.openshift.com
CATALOGSOURCE_NAME: auto-release-app-registry
E2E_RUN_TAGS: '@level0'
Expand Down
2 changes: 1 addition & 1 deletion ...ft-openshift-tests-private-release-4.12__multi-nightly-4.12-upgrade-from-stable-4.12.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -213,7 +213,7 @@ tests:
steps:
cluster_profile: azure-qe
env:
AZURE_INSTALL_USE_MINIMAL_PERMISSIONS: "true"
AZURE_INSTALL_USE_MINIMAL_PERMISSIONS: "yes"
BASE_DOMAIN: qe.azure.devcluster.openshift.com
COMPUTE_NODE_TYPE: Standard_D4ps_v5
OCP_ARCH: arm64
Expand Down
4 changes: 2 additions & 2 deletions ...penshift-tests-private/openshift-openshift-tests-private-release-4.13__multi-nightly.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -578,7 +578,7 @@ tests:
steps:
cluster_profile: azure-qe
env:
AZURE_INSTALL_USE_MINIMAL_PERMISSIONS: "true"
AZURE_INSTALL_USE_MINIMAL_PERMISSIONS: "yes"
BASE_DOMAIN: qe.azure.devcluster.openshift.com
test:
- chain: openshift-e2e-test-qe-destructive
Expand All @@ -588,7 +588,7 @@ tests:
steps:
cluster_profile: azure-qe
env:
AZURE_INSTALL_USE_MINIMAL_PERMISSIONS: "true"
AZURE_INSTALL_USE_MINIMAL_PERMISSIONS: "yes"
BASE_DOMAIN: qe.azure.devcluster.openshift.com
COMPUTE_NODE_TYPE: Standard_D4ps_v5
OCP_ARCH: arm64
Expand Down
3 changes: 1 addition & 2 deletions ...penshift-tests-private/openshift-openshift-tests-private-release-4.14__amd64-nightly.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1301,9 +1301,8 @@ tests:
steps:
cluster_profile: azure-qe
env:
AZURE_INSTALL_USE_MINIMAL_PERMISSIONS: "true"
AZURE_INSTALL_USE_MINIMAL_PERMISSIONS: "yes"
BASE_DOMAIN: qe.azure.devcluster.openshift.com
ENABLE_MIN_PERMISSION_FOR_MARKETPLACE: "true"
OS_IMAGE_VERSION: 413.92.2023101700
test:
- chain: openshift-e2e-test-qe
Expand Down
2 changes: 1 addition & 1 deletion ...ft-openshift-tests-private-release-4.14__multi-nightly-4.14-upgrade-from-stable-4.14.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -317,7 +317,7 @@ tests:
steps:
cluster_profile: azure-qe
env:
AZURE_INSTALL_USE_MINIMAL_PERMISSIONS: "true"
AZURE_INSTALL_USE_MINIMAL_PERMISSIONS: "yes"
BASE_DOMAIN: qe.azure.devcluster.openshift.com
COMPUTE_NODE_TYPE: Standard_D4ps_v5
ENABLE_MIN_PERMISSION_FOR_STS: "true"
Expand Down
12 changes: 6 additions & 6 deletions ...penshift-tests-private/openshift-openshift-tests-private-release-4.14__multi-nightly.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -646,7 +646,7 @@ tests:
steps:
cluster_profile: azure-qe
env:
AZURE_INSTALL_USE_MINIMAL_PERMISSIONS: "true"
AZURE_INSTALL_USE_MINIMAL_PERMISSIONS: "yes"
BASE_DOMAIN: qe.azure.devcluster.openshift.com
test:
- chain: openshift-e2e-test-qe-destructive
Expand All @@ -656,7 +656,7 @@ tests:
steps:
cluster_profile: azure-qe
env:
AZURE_INSTALL_USE_MINIMAL_PERMISSIONS: "true"
AZURE_INSTALL_USE_MINIMAL_PERMISSIONS: "yes"
BASE_DOMAIN: qe.azure.devcluster.openshift.com
COMPUTE_NODE_TYPE: Standard_D4ps_v5
OCP_ARCH: arm64
Expand Down Expand Up @@ -690,7 +690,7 @@ tests:
steps:
cluster_profile: azure-qe
env:
AZURE_INSTALL_USE_MINIMAL_PERMISSIONS: "true"
AZURE_INSTALL_USE_MINIMAL_PERMISSIONS: "yes"
BASE_DOMAIN: qe.azure.devcluster.openshift.com
ENABLE_MIN_PERMISSION_FOR_STS: "true"
EXTRACT_MANIFEST_INCLUDED: "true"
Expand All @@ -702,7 +702,7 @@ tests:
steps:
cluster_profile: azure-qe
env:
AZURE_INSTALL_USE_MINIMAL_PERMISSIONS: "true"
AZURE_INSTALL_USE_MINIMAL_PERMISSIONS: "yes"
BASE_DOMAIN: qe.azure.devcluster.openshift.com
COMPUTE_NODE_TYPE: Standard_D4ps_v5
ENABLE_MIN_PERMISSION_FOR_STS: "true"
Expand Down Expand Up @@ -909,7 +909,7 @@ tests:
steps:
cluster_profile: azure-qe
env:
AZURE_INSTALL_USE_MINIMAL_PERMISSIONS: "true"
AZURE_INSTALL_USE_MINIMAL_PERMISSIONS: "yes"
BASE_DOMAIN: qe.azure.devcluster.openshift.com
BOOTSTRAP_NODE_TYPE: Standard_D4ps_v5
COMPUTE_NODE_TYPE: Standard_D4ps_v5
Expand All @@ -923,7 +923,7 @@ tests:
steps:
cluster_profile: azure-qe
env:
AZURE_INSTALL_USE_MINIMAL_PERMISSIONS: "true"
AZURE_INSTALL_USE_MINIMAL_PERMISSIONS: "yes"
BASE_DOMAIN: qe.azure.devcluster.openshift.com
test:
- chain: openshift-e2e-test-qe-destructive
Expand Down
Loading