Repository: Azure/ARO-HCP
Pull request #1755: Added new attributes to the managed identities config according to the new schema
Author: login: anshulvermapatel
Created: 2025-05-14T07:23:36Z | Merged: 2025-05-20T08:33:19Z

https://issues.redhat.com/browse/ARO-17371

### What

To support multiple azure role definition for both the defined control plane and data plane operators managed identities, a new schema has been finalized and this is to add attributes for the clusters-service managed identities config according to the new schema. This is to make sure the successful deployed after the clusters-service code change to support multiple managed identities for the azure operators.



Diff:
diff --git a/cluster-service/Makefile b/cluster-service/Makefile
index 9a986cff130..95358dca8c5 100644
--- a/cluster-service/Makefile
+++ b/cluster-service/Makefile
@@ -72,13 +72,31 @@ deploy:
 	  --set azureOperatorsMI.imageRegistry.roleId="$${OP_IMAGE_REGISTRY_DRIVER_ROLE_ID}" \
 	  --set azureOperatorsMI.cloudNetworkConfig.roleName="${OP_CLOUD_NETWORK_CONFIG_ROLE_NAME}" \
 	  --set azureOperatorsMI.cloudNetworkConfig.roleId="$${OP_CLOUD_NETWORK_CONFIG_ROLE_ID}" \
+	  --set azureOperatorsMI.kms.roleName="${OP_KMS_ROLE_NAME}" \
+	  --set azureOperatorsMI.kms.roleId="$${OP_KMS_ROLE_ID}" \
+	  --set azureOperatorsMI.clusterApiAzure.roleDefinitions[0].name="${OP_CLUSTER_API_AZURE_ROLE_NAME}" \
+	  --set azureOperatorsMI.clusterApiAzure.roleDefinitions[0].id="$${OP_CLUSTER_API_AZURE_ROLE_ID}" \
+	  --set azureOperatorsMI.controlPlane.roleDefinitions[0].name="${OP_CONTROL_PLANE_ROLE_NAME}" \
+	  --set azureOperatorsMI.controlPlane.roleDefinitions[0].id="$${OP_CONTROL_PLANE_ROLE_ID}" \
+	  --set azureOperatorsMI.cloudControllerManager.roleDefinitions[0].name="${OP_CLOUD_CONTROLLER_MANAGER_ROLE_NAME}" \
+	  --set azureOperatorsMI.cloudControllerManager.roleDefinitions[0].id="$${OP_CLOUD_CONTROLLER_MANAGER_ROLE_ID}" \
+	  --set azureOperatorsMI.ingress.roleDefinitions[0].name="${OP_INGRESS_ROLE_NAME}" \
+	  --set azureOperatorsMI.ingress.roleDefinitions[0].id="$${OP_INGRESS_ROLE_ID}" \
+	  --set azureOperatorsMI.diskCsiDriver.roleDefinitions[0].name="${OP_DISK_CSI_DRIVER_ROLE_NAME}" \
+	  --set azureOperatorsMI.diskCsiDriver.roleDefinitions[0].id="$${OP_DISK_CSI_DRIVER_ROLE_ID}" \
+	  --set azureOperatorsMI.fileCsiDriver.roleDefinitions[0].name="${OP_FILE_CSI_DRIVER_ROLE_NAME}" \
+	  --set azureOperatorsMI.fileCsiDriver.roleDefinitions[0].id="$${OP_FILE_CSI_DRIVER_ROLE_ID}" \
+	  --set azureOperatorsMI.imageRegistry.roleDefinitions[0].name="${OP_IMAGE_REGISTRY_DRIVER_ROLE_NAME}" \
+	  --set azureOperatorsMI.imageRegistry.roleDefinitions[0].id="$${OP_IMAGE_REGISTRY_DRIVER_ROLE_ID}" \
+	  --set azureOperatorsMI.cloudNetworkConfig.roleDefinitions[0].name="${OP_CLOUD_NETWORK_CONFIG_ROLE_NAME}" \
+	  --set azureOperatorsMI.cloudNetworkConfig.roleDefinitions[0].id="$${OP_CLOUD_NETWORK_CONFIG_ROLE_ID}" \
+	  --set azureOperatorsMI.kms.roleDefinitions[0].name="${OP_KMS_ROLE_NAME}" \
+	  --set azureOperatorsMI.kms.roleDefinitions[0].id="$${OP_KMS_ROLE_ID}" \
 	  --set pullBinding.workloadIdentityClientId="$${IMAGE_PULLER_MI_CLIENT_ID}" \
 	  --set pullBinding.workloadIdentityTenantId="$${IMAGE_PULLER_MI_TENANT_ID}" \
 	  --set pullBinding.registry=${ACR_NAME}.azurecr.io \
 	  --set pullBinding.scope=repository:${IMAGE_REPO}:pull \
-	  --set tracing.address=${TRACING_ADDRESS} \
-	  --set azureOperatorsMI.kms.roleName="${OP_KMS_ROLE_NAME}" \
-	  --set azureOperatorsMI.kms.roleId="$${OP_KMS_ROLE_ID}"
+	  --set tracing.address=${TRACING_ADDRESS} 
 
 deploy-pr-env-deps:
 	AZURE_CS_MI_CLIENT_ID=$(shell az identity show -g ${RESOURCEGROUP} -n clusters-service --query clientId -o tsv) && \
@@ -153,6 +171,24 @@ local-azure-operators-managed-identities-config:
 	  --set azureOperatorsMI.cloudNetworkConfig.roleId="$${OP_CLOUD_NETWORK_CONFIG_ROLE_ID}" \
 	  --set azureOperatorsMI.kms.roleName="${OP_KMS_ROLE_NAME}" \
 	  --set azureOperatorsMI.kms.roleId="$${OP_KMS_ROLE_ID}" \
+	  --set azureOperatorsMI.clusterApiAzure.roleDefinitions[0].name="${OP_CLUSTER_API_AZURE_ROLE_NAME}" \
+	  --set azureOperatorsMI.clusterApiAzure.roleDefinitions[0].id="$${OP_CLUSTER_API_AZURE_ROLE_ID}" \
+	  --set azureOperatorsMI.controlPlane.roleDefinitions[0].name="${OP_CONTROL_PLANE_ROLE_NAME}" \
+	  --set azureOperatorsMI.controlPlane.roleDefinitions[0].id="$${OP_CONTROL_PLANE_ROLE_ID}" \
+	  --set azureOperatorsMI.cloudControllerManager.roleDefinitions[0].name="${OP_CLOUD_CONTROLLER_MANAGER_ROLE_NAME}" \
+	  --set azureOperatorsMI.cloudControllerManager.roleDefinitions[0].id="$${OP_CLOUD_CONTROLLER_MANAGER_ROLE_ID}" \
+	  --set azureOperatorsMI.ingress.roleDefinitions[0].name="${OP_INGRESS_ROLE_NAME}" \
+	  --set azureOperatorsMI.ingress.roleDefinitions[0].id="$${OP_INGRESS_ROLE_ID}" \
+	  --set azureOperatorsMI.diskCsiDriver.roleDefinitions[0].name="${OP_DISK_CSI_DRIVER_ROLE_NAME}" \
+	  --set azureOperatorsMI.diskCsiDriver.roleDefinitions[0].id="$${OP_DISK_CSI_DRIVER_ROLE_ID}" \
+	  --set azureOperatorsMI.fileCsiDriver.roleDefinitions[0].name="${OP_FILE_CSI_DRIVER_ROLE_NAME}" \
+	  --set azureOperatorsMI.fileCsiDriver.roleDefinitions[0].id="$${OP_FILE_CSI_DRIVER_ROLE_ID}" \
+	  --set azureOperatorsMI.imageRegistry.roleDefinitions[0].name="${OP_IMAGE_REGISTRY_DRIVER_ROLE_NAME}" \
+	  --set azureOperatorsMI.imageRegistry.roleDefinitions[0].id="$${OP_IMAGE_REGISTRY_DRIVER_ROLE_ID}" \
+	  --set azureOperatorsMI.cloudNetworkConfig.roleDefinitions[0].name="${OP_CLOUD_NETWORK_CONFIG_ROLE_NAME}" \
+	  --set azureOperatorsMI.cloudNetworkConfig.roleDefinitions[0].id="$${OP_CLOUD_NETWORK_CONFIG_ROLE_ID}" \
+	  --set azureOperatorsMI.kms.roleDefinitions[0].name="${OP_KMS_ROLE_NAME}" \
+	  --set azureOperatorsMI.kms.roleDefinitions[0].id="$${OP_KMS_ROLE_ID}" \
 	  | yq '.data."azure-operators-managed-identities-config.yaml"' > ./azure-operators-managed-identities-config.yaml
 .PHONY: local-azure-operators-managed-identities-config
 
diff --git a/cluster-service/deploy/templates/azure-operators-managed-identities-config.configmap.yaml b/cluster-service/deploy/templates/azure-operators-managed-identities-config.configmap.yaml
index 7d58bf3de6d..d9424fa5953 100644
--- a/cluster-service/deploy/templates/azure-operators-managed-identities-config.configmap.yaml
+++ b/cluster-service/deploy/templates/azure-operators-managed-identities-config.configmap.yaml
@@ -8,52 +8,102 @@ data:
     controlPlaneOperatorsIdentities:
       cluster-api-azure:
         minOpenShiftVersion: 4.18
+        roleDefinitions:
+        {{- range .Values.azureOperatorsMI.clusterApiAzure.roleDefinitions }}
+          - resourceId: '/providers/Microsoft.Authorization/roleDefinitions/{{ .id }}'
+            name: '{{ .name }}'
+        {{- end }}
         azureRoleDefinitionResourceId: '/providers/Microsoft.Authorization/roleDefinitions/{{ .Values.azureOperatorsMI.clusterApiAzure.roleId }}'
         azureRoleDefinitionName: '{{ .Values.azureOperatorsMI.clusterApiAzure.roleName }}'
         optional: false
       control-plane:
         minOpenShiftVersion: 4.18
+        roleDefinitions:
+        {{- range .Values.azureOperatorsMI.controlPlane.roleDefinitions }}
+          - resourceId: '/providers/Microsoft.Authorization/roleDefinitions/{{ .id }}'
+            name: '{{ .name }}'
+        {{- end }}
         azureRoleDefinitionResourceId: '/providers/Microsoft.Authorization/roleDefinitions/{{ .Values.azureOperatorsMI.controlPlane.roleId }}'
         azureRoleDefinitionName: '{{ .Values.azureOperatorsMI.controlPlane.roleName }}'
         optional: false
       cloud-controller-manager:
         minOpenShiftVersion: 4.18
+        roleDefinitions:
+        {{- range .Values.azureOperatorsMI.cloudControllerManager.roleDefinitions }}
+          - resourceId: '/providers/Microsoft.Authorization/roleDefinitions/{{ .id }}'
+            name: '{{ .name }}'
+        {{- end }}
         azureRoleDefinitionResourceId: '/providers/Microsoft.Authorization/roleDefinitions/{{ .Values.azureOperatorsMI.cloudControllerManager.roleId }}'
         azureRoleDefinitionName: '{{ .Values.azureOperatorsMI.cloudControllerManager.roleName }}'
         optional: false
       ingress:
         minOpenShiftVersion: 4.18
+        roleDefinitions:
+        {{- range .Values.azureOperatorsMI.ingress.roleDefinitions }}
+          - resourceId: '/providers/Microsoft.Authorization/roleDefinitions/{{ .id }}'
+            name: '{{ .name }}'
+        {{- end }}
         azureRoleDefinitionResourceId: '/providers/Microsoft.Authorization/roleDefinitions/{{ .Values.azureOperatorsMI.ingress.roleId }}'
         azureRoleDefinitionName: '{{ .Values.azureOperatorsMI.ingress.roleName }}'
         optional: false
       disk-csi-driver:
         minOpenShiftVersion: 4.18
+        roleDefinitions:
+        {{- range .Values.azureOperatorsMI.diskCsiDriver.roleDefinitions }}
+          - resourceId: '/providers/Microsoft.Authorization/roleDefinitions/{{ .id }}'
+            name: '{{ .name }}'
+        {{- end }}
         azureRoleDefinitionResourceId: '/providers/Microsoft.Authorization/roleDefinitions/{{ .Values.azureOperatorsMI.diskCsiDriver.roleId }}'
         azureRoleDefinitionName: '{{ .Values.azureOperatorsMI.diskCsiDriver.roleName }}'
         optional: false
       file-csi-driver:
         minOpenShiftVersion: 4.18
+        roleDefinitions:
+        {{- range .Values.azureOperatorsMI.fileCsiDriver.roleDefinitions }}
+          - resourceId: '/providers/Microsoft.Authorization/roleDefinitions/{{ .id }}'
+            name: '{{ .name }}'
+        {{- end }}
         azureRoleDefinitionResourceId: '/providers/Microsoft.Authorization/roleDefinitions/{{ .Values.azureOperatorsMI.fileCsiDriver.roleId }}'
         azureRoleDefinitionName: '{{ .Values.azureOperatorsMI.fileCsiDriver.roleName }}'
         optional: false
       image-registry:
         minOpenShiftVersion: 4.18
+        roleDefinitions:
+        {{- range .Values.azureOperatorsMI.imageRegistry.roleDefinitions }}
+          - resourceId: '/providers/Microsoft.Authorization/roleDefinitions/{{ .id }}'
+            name: '{{ .name }}'
+        {{- end }}
         azureRoleDefinitionResourceId: '/providers/Microsoft.Authorization/roleDefinitions/{{ .Values.azureOperatorsMI.imageRegistry.roleId }}'
         azureRoleDefinitionName: '{{ .Values.azureOperatorsMI.imageRegistry.roleName }}'
         optional: false
       cloud-network-config:
         minOpenShiftVersion: 4.18
+        roleDefinitions:
+        {{- range .Values.azureOperatorsMI.cloudNetworkConfig.roleDefinitions }}
+          - resourceId: '/providers/Microsoft.Authorization/roleDefinitions/{{ .id }}'
+            name: '{{ .name }}'
+        {{- end }}
         azureRoleDefinitionResourceId: '/providers/Microsoft.Authorization/roleDefinitions/{{ .Values.azureOperatorsMI.cloudNetworkConfig.roleId }}'
         azureRoleDefinitionName: '{{ .Values.azureOperatorsMI.cloudNetworkConfig.roleName }}'
         optional: false
       kms:
         minOpenShiftVersion: 4.18
+        roleDefinitions:
+        {{- range .Values.azureOperatorsMI.kms.roleDefinitions }}
+          - resourceId: '/providers/Microsoft.Authorization/roleDefinitions/{{ .id }}'
+            name: '{{ .name }}'
+        {{- end }}
         azureRoleDefinitionResourceId: '/providers/Microsoft.Authorization/roleDefinitions/{{ .Values.azureOperatorsMI.kms.roleId }}'
         azureRoleDefinitionName: '{{ .Values.azureOperatorsMI.kms.roleName }}'
         optional: true
     dataPlaneOperatorsIdentities:
       disk-csi-driver:
         minOpenShiftVersion: 4.18
+        roleDefinitions:
+        {{- range .Values.azureOperatorsMI.diskCsiDriver.roleDefinitions }}
+          - resourceId: '/providers/Microsoft.Authorization/roleDefinitions/{{ .id }}'
+            name: '{{ .name }}'
+        {{- end }}
         azureRoleDefinitionResourceId: '/providers/Microsoft.Authorization/roleDefinitions/{{ .Values.azureOperatorsMI.diskCsiDriver.roleId }}'
         azureRoleDefinitionName: '{{ .Values.azureOperatorsMI.diskCsiDriver.roleName }}'
         k8sServiceAccounts:
@@ -64,6 +114,11 @@ data:
         optional: false
       image-registry:
         minOpenShiftVersion: 4.18
+        roleDefinitions:
+        {{- range .Values.azureOperatorsMI.imageRegistry.roleDefinitions }}
+          - resourceId: '/providers/Microsoft.Authorization/roleDefinitions/{{ .id }}'
+            name: '{{ .name }}'
+        {{- end }}
         azureRoleDefinitionResourceId: '/providers/Microsoft.Authorization/roleDefinitions/{{ .Values.azureOperatorsMI.imageRegistry.roleId }}'
         azureRoleDefinitionName: '{{ .Values.azureOperatorsMI.imageRegistry.roleName }}'
         k8sServiceAccounts:
@@ -74,6 +129,11 @@ data:
         optional: false
       file-csi-driver:
         minOpenShiftVersion: 4.18
+        roleDefinitions:
+        {{- range .Values.azureOperatorsMI.fileCsiDriver.roleDefinitions }}
+          - resourceId: '/providers/Microsoft.Authorization/roleDefinitions/{{ .id }}'
+            name: '{{ .name }}'
+        {{- end }}
         azureRoleDefinitionResourceId: '/providers/Microsoft.Authorization/roleDefinitions/{{ .Values.azureOperatorsMI.fileCsiDriver.roleId }}'
         azureRoleDefinitionName: '{{ .Values.azureOperatorsMI.fileCsiDriver.roleName }}'
         k8sServiceAccounts:
diff --git a/cluster-service/deploy/values.yaml b/cluster-service/deploy/values.yaml
index 3ac3371071c..be75cd28f45 100644
--- a/cluster-service/deploy/values.yaml
+++ b/cluster-service/deploy/values.yaml
@@ -209,30 +209,39 @@ managedIdentitiesDataPlaneAudienceResource: "https://dummy.org"
 # The Azure Operator Managed Identities.
 azureOperatorsMI:
   clusterApiAzure:
+    roleDefinitions: []
     roleName: ''
     roleId: ''
   controlPlane:
+    roleDefinitions: []
     roleName: ''
     roleId: ''
   cloudControllerManager:
+    roleDefinitions: []
     roleName: ''
     roleId: ''
   ingress:
+    roleDefinitions: []
     roleName: ''
     roleId: ''
   diskCsiDriver:
+    roleDefinitions: []
     roleName: ''
     roleId: ''
   fileCsiDriver:
+    roleDefinitions: []
     roleName: ''
     roleId: ''
   imageRegistry:
+    roleDefinitions: []
     roleName: ''
     roleId: ''
   cloudNetworkConfig:
+    roleDefinitions: []
     roleName: ''
     roleId: ''
   kms:
+    roleDefinitions: []
     roleName: ''
     roleId: ''
 # Pull binding configuration for ACR Pull Operator


Reviews:
user: login: miguelsorianod
state: COMMENTED
author_association: COLLABORATOR
submitted_at: 2025-05-14T08:14:22Z
user: login: miguelsorianod
state: COMMENTED
author_association: COLLABORATOR
submitted_at: 2025-05-14T08:16:36Z
user: login: miguelsorianod
state: COMMENTED
author_association: COLLABORATOR
submitted_at: 2025-05-14T08:17:28Z
user: login: anshulvermapatel
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-05-14T09:51:19Z
user: login: anshulvermapatel
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-05-14T09:53:28Z
user: login: anshulvermapatel
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-05-14T09:54:40Z
user: login: machi1990
state: COMMENTED
author_association: COLLABORATOR
submitted_at: 2025-05-14T11:00:05Z
user: login: anshulvermapatel
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-05-14T20:23:31Z
user: login: anshulvermapatel
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-05-14T20:24:47Z
user: login: machi1990
state: COMMENTED
author_association: COLLABORATOR
submitted_at: 2025-05-19T07:50:37Z
user: login: miguelsorianod
state: COMMENTED
author_association: COLLABORATOR
submitted_at: 2025-05-19T09:31:30Z
user: login: anshulvermapatel
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-05-19T09:57:11Z
user: login: miguelsorianod
state: COMMENTED
author_association: COLLABORATOR
submitted_at: 2025-05-19T10:05:44Z
user: login: anshulvermapatel
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-05-19T10:14:18Z
user: login: miguelsorianod
state: COMMENTED
author_association: COLLABORATOR
submitted_at: 2025-05-19T10:16:58Z
user: login: miguelsorianod
state: COMMENTED
author_association: COLLABORATOR
submitted_at: 2025-05-19T10:17:43Z
user: login: anshulvermapatel
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-05-19T10:27:35Z
user: login: anshulvermapatel
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-05-19T10:29:41Z
user: login: miguelsorianod
state: COMMENTED
author_association: COLLABORATOR
submitted_at: 2025-05-19T10:32:33Z
user: login: miguelsorianod
state: APPROVED
author_association: COLLABORATOR
submitted_at: 2025-05-20T08:30:41Z
user: login: janboll
state: APPROVED
author_association: COLLABORATOR
submitted_at: 2025-05-20T08:32:24Z

Review comments:
diff_hunk: @@ -209,30 +209,39 @@ managedIdentitiesDataPlaneAudienceResource: "https://dummy.org"
 # The Azure Operator Managed Identities.
 azureOperatorsMI:
   clusterApiAzure:
+    roles: []
path: cluster-service/deploy/values.yaml
user: login: miguelsorianod
body: should it be roleDefinitions instead of roles ?
created_at: 2025-05-14T08:14:22Z
author_association: COLLABORATOR
diff_hunk: @@ -8,52 +8,102 @@ data:
     controlPlaneOperatorsIdentities:
       cluster-api-azure:
         minOpenShiftVersion: 4.18
+        roleDefinitions:
path: cluster-service/deploy/templates/azure-operators-managed-identities-config.configmap.yaml
user: login: miguelsorianod
body: Assuming that this defines a roleDefinitions where the value is an array of structs where the structs have the resourceId and name keys it seems good to me
created_at: 2025-05-14T08:16:36Z
author_association: COLLABORATOR
diff_hunk: @@ -8,52 +8,102 @@ data:
     controlPlaneOperatorsIdentities:
       cluster-api-azure:
         minOpenShiftVersion: 4.18
+        roleDefinitions:
+        {{- range .Values.azureOperatorsMI.clusterApiAzure.roles }}
+          - resourceId: '/providers/Microsoft.Authorization/roleDefinitions/{{ .id }}'
+            name: '{{ .name }}'
+        {{- end }}
         azureRoleDefinitionResourceId: '/providers/Microsoft.Authorization/roleDefinitions/{{ .Values.azureOperatorsMI.clusterApiAzure.roleId }}'
         azureRoleDefinitionName: '{{ .Values.azureOperatorsMI.clusterApiAzure.roleName }}'
         optional: false
       control-plane:
         minOpenShiftVersion: 4.18
+        roleDefinitions:
+        {{- range .Values.azureOperatorsMI.controlPlane.roles }}
+          - resourceId: '/providers/Microsoft.Authorization/roleDefinitions/{{ .id }}'
+            name: '{{ .name }}'
+        {{- end }}
         azureRoleDefinitionResourceId: '/providers/Microsoft.Authorization/roleDefinitions/{{ .Values.azureOperatorsMI.controlPlane.roleId }}'
         azureRoleDefinitionName: '{{ .Values.azureOperatorsMI.controlPlane.roleName }}'
         optional: false
       cloud-controller-manager:
         minOpenShiftVersion: 4.18
+        roleDefinitions:
+        {{- range .Values.azureOperatorsMI.cloudControllerManager.roles }}
+          - resourceId: '/providers/Microsoft.Authorization/roleDefinitions/{{ .id }}'
+            name: '{{ .name }}'
+        {{- end }}
         azureRoleDefinitionResourceId: '/providers/Microsoft.Authorization/roleDefinitions/{{ .Values.azureOperatorsMI.cloudControllerManager.roleId }}'
         azureRoleDefinitionName: '{{ .Values.azureOperatorsMI.cloudControllerManager.roleName }}'
         optional: false
       ingress:
         minOpenShiftVersion: 4.18
+        roleDefinitions:
+        {{- range .Values.azureOperatorsMI.ingress.roles }}
+          - resourceId: '/providers/Microsoft.Authorization/roleDefinitions/{{ .id }}'
+            name: '{{ .name }}'
+        {{- end }}
         azureRoleDefinitionResourceId: '/providers/Microsoft.Authorization/roleDefinitions/{{ .Values.azureOperatorsMI.ingress.roleId }}'
         azureRoleDefinitionName: '{{ .Values.azureOperatorsMI.ingress.roleName }}'
         optional: false
       disk-csi-driver:
         minOpenShiftVersion: 4.18
+        roleDefinitions:
+        {{- range .Values.azureOperatorsMI.diskCsiDriver.roles }}
+          - resourceId: '/providers/Microsoft.Authorization/roleDefinitions/{{ .id }}'
+            name: '{{ .name }}'
+        {{- end }}
         azureRoleDefinitionResourceId: '/providers/Microsoft.Authorization/roleDefinitions/{{ .Values.azureOperatorsMI.diskCsiDriver.roleId }}'
         azureRoleDefinitionName: '{{ .Values.azureOperatorsMI.diskCsiDriver.roleName }}'
         optional: false
       file-csi-driver:
         minOpenShiftVersion: 4.18
+        roleDefinitions:
+        {{- range .Values.azureOperatorsMI.fileCsiDriver.roles }}
+          - resourceId: '/providers/Microsoft.Authorization/roleDefinitions/{{ .id }}'
+            name: '{{ .name }}'
+        {{- end }}
         azureRoleDefinitionResourceId: '/providers/Microsoft.Authorization/roleDefinitions/{{ .Values.azureOperatorsMI.fileCsiDriver.roleId }}'
         azureRoleDefinitionName: '{{ .Values.azureOperatorsMI.fileCsiDriver.roleName }}'
         optional: false
       image-registry:
         minOpenShiftVersion: 4.18
+        roleDefinitions:
+        {{- range .Values.azureOperatorsMI.imageRegistry.roles }}
+          - resourceId: '/providers/Microsoft.Authorization/roleDefinitions/{{ .id }}'
path: cluster-service/deploy/templates/azure-operators-managed-identities-config.configmap.yaml
user: login: miguelsorianod
body: Would the variable be .id or .resourceId?
created_at: 2025-05-14T08:17:28Z
author_association: COLLABORATOR
diff_hunk: @@ -209,30 +209,39 @@ managedIdentitiesDataPlaneAudienceResource: "https://dummy.org"
 # The Azure Operator Managed Identities.
 azureOperatorsMI:
   clusterApiAzure:
+    roles: []
path: cluster-service/deploy/values.yaml
user: login: anshulvermapatel
body: Yes .. roleDefinitions for sure..
created_at: 2025-05-14T09:51:19Z
author_association: CONTRIBUTOR
diff_hunk: @@ -8,52 +8,102 @@ data:
     controlPlaneOperatorsIdentities:
       cluster-api-azure:
         minOpenShiftVersion: 4.18
+        roleDefinitions:
path: cluster-service/deploy/templates/azure-operators-managed-identities-config.configmap.yaml
user: login: anshulvermapatel
body: Yes indeed it is an array of roledefinitions.. I had to deploy a dev env .. and I deployed with this configuration .. have a look at the CS configmap:
```
file-csi-driver:
        minOpenShiftVersion: 4.18
        roleDefinitions:
          - resourceId: '/providers/Microsoft.Authorization/roleDefinitions/xxxxxxxxxxxxxx'
            name: 'File Storage Operator - Dev'
        azureRoleDefinitionResourceId: '/providers/Microsoft.Authorization/roleDefinitions/xxxxxxxxxxxxxxxxxx'
        azureRoleDefinitionName: 'File Storage Operator - Dev'
```
created_at: 2025-05-14T09:53:27Z
author_association: CONTRIBUTOR
diff_hunk: @@ -8,52 +8,102 @@ data:
     controlPlaneOperatorsIdentities:
       cluster-api-azure:
         minOpenShiftVersion: 4.18
+        roleDefinitions:
+        {{- range .Values.azureOperatorsMI.clusterApiAzure.roles }}
+          - resourceId: '/providers/Microsoft.Authorization/roleDefinitions/{{ .id }}'
+            name: '{{ .name }}'
+        {{- end }}
         azureRoleDefinitionResourceId: '/providers/Microsoft.Authorization/roleDefinitions/{{ .Values.azureOperatorsMI.clusterApiAzure.roleId }}'
         azureRoleDefinitionName: '{{ .Values.azureOperatorsMI.clusterApiAzure.roleName }}'
         optional: false
       control-plane:
         minOpenShiftVersion: 4.18
+        roleDefinitions:
+        {{- range .Values.azureOperatorsMI.controlPlane.roles }}
+          - resourceId: '/providers/Microsoft.Authorization/roleDefinitions/{{ .id }}'
+            name: '{{ .name }}'
+        {{- end }}
         azureRoleDefinitionResourceId: '/providers/Microsoft.Authorization/roleDefinitions/{{ .Values.azureOperatorsMI.controlPlane.roleId }}'
         azureRoleDefinitionName: '{{ .Values.azureOperatorsMI.controlPlane.roleName }}'
         optional: false
       cloud-controller-manager:
         minOpenShiftVersion: 4.18
+        roleDefinitions:
+        {{- range .Values.azureOperatorsMI.cloudControllerManager.roles }}
+          - resourceId: '/providers/Microsoft.Authorization/roleDefinitions/{{ .id }}'
+            name: '{{ .name }}'
+        {{- end }}
         azureRoleDefinitionResourceId: '/providers/Microsoft.Authorization/roleDefinitions/{{ .Values.azureOperatorsMI.cloudControllerManager.roleId }}'
         azureRoleDefinitionName: '{{ .Values.azureOperatorsMI.cloudControllerManager.roleName }}'
         optional: false
       ingress:
         minOpenShiftVersion: 4.18
+        roleDefinitions:
+        {{- range .Values.azureOperatorsMI.ingress.roles }}
+          - resourceId: '/providers/Microsoft.Authorization/roleDefinitions/{{ .id }}'
+            name: '{{ .name }}'
+        {{- end }}
         azureRoleDefinitionResourceId: '/providers/Microsoft.Authorization/roleDefinitions/{{ .Values.azureOperatorsMI.ingress.roleId }}'
         azureRoleDefinitionName: '{{ .Values.azureOperatorsMI.ingress.roleName }}'
         optional: false
       disk-csi-driver:
         minOpenShiftVersion: 4.18
+        roleDefinitions:
+        {{- range .Values.azureOperatorsMI.diskCsiDriver.roles }}
+          - resourceId: '/providers/Microsoft.Authorization/roleDefinitions/{{ .id }}'
+            name: '{{ .name }}'
+        {{- end }}
         azureRoleDefinitionResourceId: '/providers/Microsoft.Authorization/roleDefinitions/{{ .Values.azureOperatorsMI.diskCsiDriver.roleId }}'
         azureRoleDefinitionName: '{{ .Values.azureOperatorsMI.diskCsiDriver.roleName }}'
         optional: false
       file-csi-driver:
         minOpenShiftVersion: 4.18
+        roleDefinitions:
+        {{- range .Values.azureOperatorsMI.fileCsiDriver.roles }}
+          - resourceId: '/providers/Microsoft.Authorization/roleDefinitions/{{ .id }}'
+            name: '{{ .name }}'
+        {{- end }}
         azureRoleDefinitionResourceId: '/providers/Microsoft.Authorization/roleDefinitions/{{ .Values.azureOperatorsMI.fileCsiDriver.roleId }}'
         azureRoleDefinitionName: '{{ .Values.azureOperatorsMI.fileCsiDriver.roleName }}'
         optional: false
       image-registry:
         minOpenShiftVersion: 4.18
+        roleDefinitions:
+        {{- range .Values.azureOperatorsMI.imageRegistry.roles }}
+          - resourceId: '/providers/Microsoft.Authorization/roleDefinitions/{{ .id }}'
path: cluster-service/deploy/templates/azure-operators-managed-identities-config.configmap.yaml
user: login: anshulvermapatel
body: I just put `id` thinking of the context .. however, `.resourceId` should be good.
created_at: 2025-05-14T09:54:40Z
author_association: CONTRIBUTOR
diff_hunk: @@ -8,52 +8,102 @@ data:
     controlPlaneOperatorsIdentities:
       cluster-api-azure:
         minOpenShiftVersion: 4.18
+        roleDefinitions:
+        {{- range .Values.azureOperatorsMI.clusterApiAzure.roles }}
+          - resourceId: '/providers/Microsoft.Authorization/roleDefinitions/{{ .id }}'
path: cluster-service/deploy/templates/azure-operators-managed-identities-config.configmap.yaml
user: login: machi1990
body: ```suggestion
          - resourceId: '/providers/Microsoft.Authorization/roleDefinitions/{{ . resourceId }}'
```

should it be `{{ . resourceId}}` instead of `{{ .id }}` everywhere?
created_at: 2025-05-14T11:00:05Z
author_association: COLLABORATOR
diff_hunk: @@ -8,52 +8,102 @@ data:
     controlPlaneOperatorsIdentities:
       cluster-api-azure:
         minOpenShiftVersion: 4.18
+        roleDefinitions:
+        {{- range .Values.azureOperatorsMI.clusterApiAzure.roles }}
+          - resourceId: '/providers/Microsoft.Authorization/roleDefinitions/{{ .id }}'
+            name: '{{ .name }}'
+        {{- end }}
         azureRoleDefinitionResourceId: '/providers/Microsoft.Authorization/roleDefinitions/{{ .Values.azureOperatorsMI.clusterApiAzure.roleId }}'
         azureRoleDefinitionName: '{{ .Values.azureOperatorsMI.clusterApiAzure.roleName }}'
         optional: false
       control-plane:
         minOpenShiftVersion: 4.18
+        roleDefinitions:
+        {{- range .Values.azureOperatorsMI.controlPlane.roles }}
+          - resourceId: '/providers/Microsoft.Authorization/roleDefinitions/{{ .id }}'
+            name: '{{ .name }}'
+        {{- end }}
         azureRoleDefinitionResourceId: '/providers/Microsoft.Authorization/roleDefinitions/{{ .Values.azureOperatorsMI.controlPlane.roleId }}'
         azureRoleDefinitionName: '{{ .Values.azureOperatorsMI.controlPlane.roleName }}'
         optional: false
       cloud-controller-manager:
         minOpenShiftVersion: 4.18
+        roleDefinitions:
+        {{- range .Values.azureOperatorsMI.cloudControllerManager.roles }}
+          - resourceId: '/providers/Microsoft.Authorization/roleDefinitions/{{ .id }}'
+            name: '{{ .name }}'
+        {{- end }}
         azureRoleDefinitionResourceId: '/providers/Microsoft.Authorization/roleDefinitions/{{ .Values.azureOperatorsMI.cloudControllerManager.roleId }}'
         azureRoleDefinitionName: '{{ .Values.azureOperatorsMI.cloudControllerManager.roleName }}'
         optional: false
       ingress:
         minOpenShiftVersion: 4.18
+        roleDefinitions:
+        {{- range .Values.azureOperatorsMI.ingress.roles }}
+          - resourceId: '/providers/Microsoft.Authorization/roleDefinitions/{{ .id }}'
+            name: '{{ .name }}'
+        {{- end }}
         azureRoleDefinitionResourceId: '/providers/Microsoft.Authorization/roleDefinitions/{{ .Values.azureOperatorsMI.ingress.roleId }}'
         azureRoleDefinitionName: '{{ .Values.azureOperatorsMI.ingress.roleName }}'
         optional: false
       disk-csi-driver:
         minOpenShiftVersion: 4.18
+        roleDefinitions:
+        {{- range .Values.azureOperatorsMI.diskCsiDriver.roles }}
+          - resourceId: '/providers/Microsoft.Authorization/roleDefinitions/{{ .id }}'
+            name: '{{ .name }}'
+        {{- end }}
         azureRoleDefinitionResourceId: '/providers/Microsoft.Authorization/roleDefinitions/{{ .Values.azureOperatorsMI.diskCsiDriver.roleId }}'
         azureRoleDefinitionName: '{{ .Values.azureOperatorsMI.diskCsiDriver.roleName }}'
         optional: false
       file-csi-driver:
         minOpenShiftVersion: 4.18
+        roleDefinitions:
+        {{- range .Values.azureOperatorsMI.fileCsiDriver.roles }}
+          - resourceId: '/providers/Microsoft.Authorization/roleDefinitions/{{ .id }}'
+            name: '{{ .name }}'
+        {{- end }}
         azureRoleDefinitionResourceId: '/providers/Microsoft.Authorization/roleDefinitions/{{ .Values.azureOperatorsMI.fileCsiDriver.roleId }}'
         azureRoleDefinitionName: '{{ .Values.azureOperatorsMI.fileCsiDriver.roleName }}'
         optional: false
       image-registry:
         minOpenShiftVersion: 4.18
+        roleDefinitions:
+        {{- range .Values.azureOperatorsMI.imageRegistry.roles }}
+          - resourceId: '/providers/Microsoft.Authorization/roleDefinitions/{{ .id }}'
path: cluster-service/deploy/templates/azure-operators-managed-identities-config.configmap.yaml
user: login: anshulvermapatel
body: I am sorry .. actually, this is roleId .. and since this is the array of roleIds and role names .. I chose just `id` and `name`. I am for now reverting back to `id` from `resourceId`
created_at: 2025-05-14T20:23:31Z
author_association: CONTRIBUTOR
diff_hunk: @@ -8,52 +8,102 @@ data:
     controlPlaneOperatorsIdentities:
       cluster-api-azure:
         minOpenShiftVersion: 4.18
+        roleDefinitions:
+        {{- range .Values.azureOperatorsMI.clusterApiAzure.roles }}
+          - resourceId: '/providers/Microsoft.Authorization/roleDefinitions/{{ .id }}'
path: cluster-service/deploy/templates/azure-operators-managed-identities-config.configmap.yaml
user: login: anshulvermapatel
body: So it is not the full resource id, if you look at it, the role id is getting embedded in the resource id. So it is actually roleId not resourceId, I am reverting my previous changes also to `id` from `resourceId`
created_at: 2025-05-14T20:24:47Z
author_association: CONTRIBUTOR
diff_hunk: @@ -8,52 +8,102 @@ data:
     controlPlaneOperatorsIdentities:
       cluster-api-azure:
         minOpenShiftVersion: 4.18
+        roleDefinitions:
+        {{- range .Values.azureOperatorsMI.clusterApiAzure.roles }}
+          - resourceId: '/providers/Microsoft.Authorization/roleDefinitions/{{ .id }}'
path: cluster-service/deploy/templates/azure-operators-managed-identities-config.configmap.yaml
user: login: machi1990
body: ack, thanks for confirming
created_at: 2025-05-19T07:50:37Z
author_association: COLLABORATOR
diff_hunk: @@ -72,13 +72,31 @@ deploy:
 	  --set azureOperatorsMI.imageRegistry.roleId="$${OP_IMAGE_REGISTRY_DRIVER_ROLE_ID}" \
 	  --set azureOperatorsMI.cloudNetworkConfig.roleName="${OP_CLOUD_NETWORK_CONFIG_ROLE_NAME}" \
 	  --set azureOperatorsMI.cloudNetworkConfig.roleId="$${OP_CLOUD_NETWORK_CONFIG_ROLE_ID}" \
+	  --set azureOperatorsMI.kms.roleName="${OP_KMS_ROLE_NAME}" \
+	  --set azureOperatorsMI.kms.roleId="$${OP_KMS_ROLE_ID}" \
+	  --set azureOperatorsMI.clusterApiAzure.roles[0].name="${OP_CLUSTER_API_AZURE_ROLE_NAME}" \
path: cluster-service/Makefile
user: login: miguelsorianod
body: I see it references roles, name and id.  The attribute names don't seem to match what's specified in the values.yaml file.
Is that correct and intended?
created_at: 2025-05-19T09:31:30Z
author_association: COLLABORATOR
diff_hunk: @@ -72,13 +72,31 @@ deploy:
 	  --set azureOperatorsMI.imageRegistry.roleId="$${OP_IMAGE_REGISTRY_DRIVER_ROLE_ID}" \
 	  --set azureOperatorsMI.cloudNetworkConfig.roleName="${OP_CLOUD_NETWORK_CONFIG_ROLE_NAME}" \
 	  --set azureOperatorsMI.cloudNetworkConfig.roleId="$${OP_CLOUD_NETWORK_CONFIG_ROLE_ID}" \
+	  --set azureOperatorsMI.kms.roleName="${OP_KMS_ROLE_NAME}" \
+	  --set azureOperatorsMI.kms.roleId="$${OP_KMS_ROLE_ID}" \
+	  --set azureOperatorsMI.clusterApiAzure.roles[0].name="${OP_CLUSTER_API_AZURE_ROLE_NAME}" \
path: cluster-service/Makefile
user: login: anshulvermapatel
body: no they are incorrect. 

Corrected them now, please have a look.
created_at: 2025-05-19T09:57:11Z
author_association: CONTRIBUTOR
diff_hunk: @@ -72,13 +72,31 @@ deploy:
 	  --set azureOperatorsMI.imageRegistry.roleId="$${OP_IMAGE_REGISTRY_DRIVER_ROLE_ID}" \
 	  --set azureOperatorsMI.cloudNetworkConfig.roleName="${OP_CLOUD_NETWORK_CONFIG_ROLE_NAME}" \
 	  --set azureOperatorsMI.cloudNetworkConfig.roleId="$${OP_CLOUD_NETWORK_CONFIG_ROLE_ID}" \
+	  --set azureOperatorsMI.kms.roleName="${OP_KMS_ROLE_NAME}" \
+	  --set azureOperatorsMI.kms.roleId="$${OP_KMS_ROLE_ID}" \
+	  --set azureOperatorsMI.clusterApiAzure.roles[0].name="${OP_CLUSTER_API_AZURE_ROLE_NAME}" \
path: cluster-service/Makefile
user: login: miguelsorianod
body:  Although I see now we reference roleDefinitions I still see references to .name and .id instead of .roleName and .roleDefinitionId. Is that correct and intended? same applies to the references in the configmap yaml
created_at: 2025-05-19T10:05:44Z
author_association: COLLABORATOR
diff_hunk: @@ -72,13 +72,31 @@ deploy:
 	  --set azureOperatorsMI.imageRegistry.roleId="$${OP_IMAGE_REGISTRY_DRIVER_ROLE_ID}" \
 	  --set azureOperatorsMI.cloudNetworkConfig.roleName="${OP_CLOUD_NETWORK_CONFIG_ROLE_NAME}" \
 	  --set azureOperatorsMI.cloudNetworkConfig.roleId="$${OP_CLOUD_NETWORK_CONFIG_ROLE_ID}" \
+	  --set azureOperatorsMI.kms.roleName="${OP_KMS_ROLE_NAME}" \
+	  --set azureOperatorsMI.kms.roleId="$${OP_KMS_ROLE_ID}" \
+	  --set azureOperatorsMI.clusterApiAzure.roles[0].name="${OP_CLUSTER_API_AZURE_ROLE_NAME}" \
path: cluster-service/Makefile
user: login: anshulvermapatel
body: Yes that is intended. I kept it like that as this is an array of roleDefinitions.
created_at: 2025-05-19T10:14:18Z
author_association: CONTRIBUTOR
diff_hunk: @@ -72,13 +72,31 @@ deploy:
 	  --set azureOperatorsMI.imageRegistry.roleId="$${OP_IMAGE_REGISTRY_DRIVER_ROLE_ID}" \
 	  --set azureOperatorsMI.cloudNetworkConfig.roleName="${OP_CLOUD_NETWORK_CONFIG_ROLE_NAME}" \
 	  --set azureOperatorsMI.cloudNetworkConfig.roleId="$${OP_CLOUD_NETWORK_CONFIG_ROLE_ID}" \
+	  --set azureOperatorsMI.kms.roleName="${OP_KMS_ROLE_NAME}" \
+	  --set azureOperatorsMI.kms.roleId="$${OP_KMS_ROLE_ID}" \
+	  --set azureOperatorsMI.clusterApiAzure.roles[0].name="${OP_CLUSTER_API_AZURE_ROLE_NAME}" \
path: cluster-service/Makefile
user: login: miguelsorianod
body: If it is intended, why is that some are referenced as .id, name ( azureOperatorsMI.kms.roleName)  and others as .roleId, .roleName ( azureOperatorsMI.clusterApiAzure.roleDefinitions[0].name) ?
created_at: 2025-05-19T10:16:58Z
author_association: COLLABORATOR
diff_hunk: @@ -72,13 +72,31 @@ deploy:
 	  --set azureOperatorsMI.imageRegistry.roleId="$${OP_IMAGE_REGISTRY_DRIVER_ROLE_ID}" \
 	  --set azureOperatorsMI.cloudNetworkConfig.roleName="${OP_CLOUD_NETWORK_CONFIG_ROLE_NAME}" \
 	  --set azureOperatorsMI.cloudNetworkConfig.roleId="$${OP_CLOUD_NETWORK_CONFIG_ROLE_ID}" \
+	  --set azureOperatorsMI.kms.roleName="${OP_KMS_ROLE_NAME}" \
+	  --set azureOperatorsMI.kms.roleId="$${OP_KMS_ROLE_ID}" \
+	  --set azureOperatorsMI.clusterApiAzure.roles[0].name="${OP_CLUSTER_API_AZURE_ROLE_NAME}" \
path: cluster-service/Makefile
user: login: miguelsorianod
body: and how does that relate  to the attribute names in the values.yaml file ?
created_at: 2025-05-19T10:17:43Z
author_association: COLLABORATOR
diff_hunk: @@ -72,13 +72,31 @@ deploy:
 	  --set azureOperatorsMI.imageRegistry.roleId="$${OP_IMAGE_REGISTRY_DRIVER_ROLE_ID}" \
 	  --set azureOperatorsMI.cloudNetworkConfig.roleName="${OP_CLOUD_NETWORK_CONFIG_ROLE_NAME}" \
 	  --set azureOperatorsMI.cloudNetworkConfig.roleId="$${OP_CLOUD_NETWORK_CONFIG_ROLE_ID}" \
+	  --set azureOperatorsMI.kms.roleName="${OP_KMS_ROLE_NAME}" \
+	  --set azureOperatorsMI.kms.roleId="$${OP_KMS_ROLE_ID}" \
+	  --set azureOperatorsMI.clusterApiAzure.roles[0].name="${OP_CLUSTER_API_AZURE_ROLE_NAME}" \
path: cluster-service/Makefile
user: login: anshulvermapatel
body: `azureOperatorsMI.kms.roleName` this refer to the old schema of the configuration file which we need to keep until we deploy the new CS code. THe KMS one, I just shifted it with other similar flags just to keep them together.
created_at: 2025-05-19T10:27:35Z
author_association: CONTRIBUTOR
diff_hunk: @@ -72,13 +72,31 @@ deploy:
 	  --set azureOperatorsMI.imageRegistry.roleId="$${OP_IMAGE_REGISTRY_DRIVER_ROLE_ID}" \
 	  --set azureOperatorsMI.cloudNetworkConfig.roleName="${OP_CLOUD_NETWORK_CONFIG_ROLE_NAME}" \
 	  --set azureOperatorsMI.cloudNetworkConfig.roleId="$${OP_CLOUD_NETWORK_CONFIG_ROLE_ID}" \
+	  --set azureOperatorsMI.kms.roleName="${OP_KMS_ROLE_NAME}" \
+	  --set azureOperatorsMI.kms.roleId="$${OP_KMS_ROLE_ID}" \
+	  --set azureOperatorsMI.clusterApiAzure.roles[0].name="${OP_CLUSTER_API_AZURE_ROLE_NAME}" \
path: cluster-service/Makefile
user: login: anshulvermapatel
body: > and how does that relate to the attribute names in the values.yaml file ?
The values.yaml already have:
~~~
    roleName: ''
    roleId: ''
~~~
as per the old schema. These will be removed once the new CS code according to the new schema gets merges and deployed.
created_at: 2025-05-19T10:29:41Z
author_association: CONTRIBUTOR
diff_hunk: @@ -72,13 +72,31 @@ deploy:
 	  --set azureOperatorsMI.imageRegistry.roleId="$${OP_IMAGE_REGISTRY_DRIVER_ROLE_ID}" \
 	  --set azureOperatorsMI.cloudNetworkConfig.roleName="${OP_CLOUD_NETWORK_CONFIG_ROLE_NAME}" \
 	  --set azureOperatorsMI.cloudNetworkConfig.roleId="$${OP_CLOUD_NETWORK_CONFIG_ROLE_ID}" \
+	  --set azureOperatorsMI.kms.roleName="${OP_KMS_ROLE_NAME}" \
+	  --set azureOperatorsMI.kms.roleId="$${OP_KMS_ROLE_ID}" \
+	  --set azureOperatorsMI.clusterApiAzure.roles[0].name="${OP_CLUSTER_API_AZURE_ROLE_NAME}" \
path: cluster-service/Makefile
user: login: miguelsorianod
body: Understood 👍 . That makes sense to me
created_at: 2025-05-19T10:32:33Z
author_association: COLLABORATOR

PR comments:
user: login: miguelsorianod
created_at: 2025-05-14T08:18:14Z
body: I'll defer the review of changes around helm to the lifecycle team
author_association: COLLABORATOR
user: login: miguelsorianod
created_at: 2025-05-14T08:21:08Z
body: Is there some way to trigger the generation of the file locally to verify the changes?
author_association: COLLABORATOR
user: login: anshulvermapatel
created_at: 2025-05-14T09:58:23Z
body: Yes, we can export the chart into a single template. However, I had to deploy an environment to test the CS changes .. and I deployed it with these changes and I see it is working as expected.
author_association: CONTRIBUTOR
user: login: machi1990
created_at: 2025-05-19T07:51:35Z
body: lgtm
author_association: COLLABORATOR
user: login: miguelsorianod
created_at: 2025-05-19T09:28:05Z
body: > Yes, we can export the chart into a single template. However, I had to deploy an environment to test the CS changes .. and I deployed it with these changes and I see it is working as expected.

@janboll is there some way to generate the changes without needing to deploy an environment?
author_association: COLLABORATOR
user: login: anshulvermapatel
created_at: 2025-05-20T06:35:18Z
body: > is there some way to generate the changes without needing to deploy an environment?

Yes there is.
https://github.com/Azure/ARO-HCP/blob/main/cluster-service/Makefile#L127-L156
@miguelsorianod 
author_association: CONTRIBUTOR
user: login: machi1990
created_at: 2025-05-20T06:54:56Z
body: > > is there some way to generate the changes without needing to deploy an environment?
> 
> Yes there is. https://github.com/Azure/ARO-HCP/blob/main/cluster-service/Makefile#L127-L156 @miguelsorianod

+1. Can you run the command and share the output as part of the PR's description? This could be part of the manual verifications that the reviewers can see that they've already been done. It sets the tone for the expected output.

author_association: COLLABORATOR
user: login: anshulvermapatel
created_at: 2025-05-20T07:44:45Z
body: Here is how its is getting generated. I even deployed it in my dev env and it is working as expected.
~~~
% cat azure-operators-managed-identities-config.yaml
controlPlaneOperatorsIdentities:
  cluster-api-azure:
    minOpenShiftVersion: 4.18
    roleDefinitions:
      - resourceId: '<resource_id>'
        name: '<name>'
    azureRoleDefinitionResourceId: '<resource_id>'
    azureRoleDefinitionName: '<name>'
    optional: false
  control-plane:
    minOpenShiftVersion: 4.18
    roleDefinitions:
      - resourceId: '<resource_id>'
        name: '<name>'
    azureRoleDefinitionResourceId: '<resource_id>'
    azureRoleDefinitionName: '<name>'
    optional: false
.
.
.
<enacted>
.
.
.
dataPlaneOperatorsIdentities:
  disk-csi-driver:
    minOpenShiftVersion: 4.18
    roleDefinitions:
      - resourceId: '<resource_id>'
        name: '<name>'
    azureRoleDefinitionResourceId: '<resource_id>'
    azureRoleDefinitionName: '<name>'
    k8sServiceAccounts:
      - name: '<name>'
        namespace: '<ns>'
      - name: '<name>'
        namespace: '<ns>'
    optional: false
~~~
author_association: CONTRIBUTOR
user: login: miguelsorianod
created_at: 2025-05-20T08:29:44Z
body: > Here is how its is getting generated. I even deployed it in my dev env and it is working as expected.
> 
> ```
> % cat azure-operators-managed-identities-config.yaml
> controlPlaneOperatorsIdentities:
>   cluster-api-azure:
>     minOpenShiftVersion: 4.18
>     roleDefinitions:
>       - resourceId: '<resource_id>'
>         name: '<name>'
>     azureRoleDefinitionResourceId: '<resource_id>'
>     azureRoleDefinitionName: '<name>'
>     optional: false
>   control-plane:
>     minOpenShiftVersion: 4.18
>     roleDefinitions:
>       - resourceId: '<resource_id>'
>         name: '<name>'
>     azureRoleDefinitionResourceId: '<resource_id>'
>     azureRoleDefinitionName: '<name>'
>     optional: false
> .
> .
> .
> <enacted>
> .
> .
> .
> dataPlaneOperatorsIdentities:
>   disk-csi-driver:
>     minOpenShiftVersion: 4.18
>     roleDefinitions:
>       - resourceId: '<resource_id>'
>         name: '<name>'
>     azureRoleDefinitionResourceId: '<resource_id>'
>     azureRoleDefinitionName: '<name>'
>     k8sServiceAccounts:
>       - name: '<name>'
>         namespace: '<ns>'
>       - name: '<name>'
>         namespace: '<ns>'
>     optional: false
> ```

Thanks, this kind of information is very useful for the reviewers
author_association: COLLABORATOR
user: login: miguelsorianod
created_at: 2025-05-20T08:30:27Z
body: looks good to me
author_association: COLLABORATOR