feat(azure): user-assigned managed identities (Microsoft.ManagedIdentity) - #910
Merged
Merged
Conversation
…ity) Add Microsoft.ManagedIdentity/userAssignedIdentities: a new managedidentity handler package (PUT/GET/DELETE/ListByRG/ListBySub, sync-200/201, no LRO) backed by a new provider Mock that mints stable clientId/principalId/tenantId once and never regenerates them, with snapshot persistence and RG-delete cascade. Resolve the ARG collision: microsoft.managedidentity/userassignedidentities was mapped to iam/User (AAD users, an unrelated concept). Repoint it to the real managed-identity resource (iam/UserAssignedIdentity), discovered via a new inventory adapter; AAD users keep their own label.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Adds Azure user-assigned managed identities (
Microsoft.ManagedIdentity/userAssignedIdentities).server/azure/managedidentity/ARM handler:PUT(create/update),GET,DELETE,ListByResourceGroup,ListBySubscription, plusPATCH. All synchronous —201on create,200on update/get,200/204on delete. ThearmmsiUserAssignedIdentitiesClientis not aBegin*poller, so there is no LRO plumbing and nooperationStatusesresponder to wire (avoids the poller-hang trap entirely).providers/azure/managedidentity: mintsclientId/principalId/tenantIdonce at create time and persists them. They are never regenerated on a read — clients captureprincipalIdto grant the identity RBAC role assignments, so a per-read regeneration would silently break those assignments.tenantIdis shared across all identities in the estate (matches real Azure).DriversFrom; new provider field is picked up automatically bySnapshotServices(identity-preserving persistence) and machine-guarded bypersist/completeness_test.go.PurgeResourceGroupcascade so a resource-group delete tears down its identities.ARG collision resolution
microsoft.managedidentity/userassignedidentitieswas already mapped in Resource Graph — but toiam/User, i.e. Azure AD users (walkIAM→IAM.ListUsers), an unrelated concept. Adding the real managed-identity type would have been a duplicate map key (compile error) and a semantic collision.Resolution (confirmed the old entry served no real purpose — AAD users are not ARM/Resource Graph resources, and no test depended on the mapping):
resourcegraph/kql.go):microsoft.managedidentity/userassignedidentities→iam/UserAssignedIdentity(wasiam/User) — now resolves to the real managed-identity resource, discovered through a new inventory adapter.resourcegraph/handler.go): dropped the staleiam/User→ managed-identity entry (AAD users now fall back to their owniam/userlabel, non-colliding) and addediam/UserAssignedIdentity→ the ARM type.TypeUserAssignedIdentityconst + aGenericResourcesdiscovery adapter (managedIdentityDiscovery, mirroringazureMLDiscovery) so identities surface in Resource Graph /az resource list.Architecture fit
Follows the established Azure-only patterns: interface-in-server-package backend (like
aksserver.Backend), provider Mock holding amemstore.Storebehindsnapshot.Snapshottable, and the genericExtra/GenericResourcesinventory projection rather than widening any cross-cloud driver. No data plane (managed identities have none — matches the TDE boundary).Test
Real-SDK e2e with
armmsi.UserAssignedIdentitiesClientagainst a livehttptestserver: create → Get round-trips a stableprincipalId/clientId/tenantId, a second Get returns the same ids, update preserves them,ListByResourceGroup/ListBySubscriptionscoping, and delete →404. Plus provider unit tests (id stability, shared tenant, purge cascade, snapshot round-trip) and a Resource Graph mapping test locking in the collision resolution.docs/coverage/regenerated.Refs #611.