Repository: Azure/ARO-RP
Pull request #2367 (2022-08-30 18:33:45)

Update Shared RP Custom Role Permissions
### Which issue this PR addresses:

This PR addresses [Bug 15410842](https://dev.azure.com/msazure/AzureRedHatOpenShift/_workitems/edit/15410842) which prevents a shared RP from creating clusters with only resource group write permission on the subscription. It now also needs resource group read permission.

### What this PR does / why we need it:

This PR adds the `Microsoft.Resources/subscriptions/resourceGroups/read` permission to the "ARO v4 Development First Party Subscription (DEV)" role definition in the `rbac-development.json` ARM template. Without this permission, shared/local RP's cannot be used to create ARO clusters.

### Test plan for issue:

I manually added the "Microsoft.Resources/subscriptions/resourceGroups/read" permission to the "ARO v4 Development First Party Subscription (DEV)" in the local dev subscription, then verified I was able to create clusters using a shared RP.

### Is there any documentation that needs to be updated for this PR?

No - this change does not require any changes to the existing shared RP setup documentation



Patch:
diff --git a/cmd/aro/mirror.go b/cmd/aro/mirror.go
index b47fe83ad..110aed915 100644
--- a/cmd/aro/mirror.go
+++ b/cmd/aro/mirror.go
@@ -161,7 +161,6 @@ func mirror(ctx context.Context, log *logrus.Entry) error {
 		"registry.access.redhat.com/ubi8/nodejs-14:latest",
 		"registry.access.redhat.com/ubi7/go-toolset:1.16.12",
 		"registry.access.redhat.com/ubi8/go-toolset:1.17.7",
-		"mcr.microsoft.com/azure-cli:latest",
 
 		"quay.io/app-sre/managed-upgrade-operator:v0.1.856-eebbe07",
 		"quay.io/app-sre/hive:56adaaa",
diff --git a/pkg/deploy/assets/rbac-development.json b/pkg/deploy/assets/rbac-development.json
index a91df19f0..0d52a98b0 100644
--- a/pkg/deploy/assets/rbac-development.json
+++ b/pkg/deploy/assets/rbac-development.json
@@ -25,6 +25,7 @@
                 "permissions": [
                     {
                         "actions": [
+                            "Microsoft.Resources/subscriptions/resourceGroups/read",
                             "Microsoft.Resources/subscriptions/resourceGroups/write"
                         ]
                     }
diff --git a/pkg/util/namespace/namespace.go b/pkg/util/namespace/namespace.go
index 74a6f23b1..dbb4952b1 100644
--- a/pkg/util/namespace/namespace.go
+++ b/pkg/util/namespace/namespace.go
@@ -29,7 +29,6 @@ func IsOpenShiftNamespace(ns string) bool {
 		"openshift-cluster-node-tuning-operator":           {},
 		"openshift-cluster-samples-operator":               {},
 		"openshift-cluster-storage-operator":               {},
-		"openshift-cluster-version":                        {},
 		"openshift-config":                                 {},
 		"openshift-config-managed":                         {},
 		"openshift-config-operator":                        {},


Test patch:
diff --git a/pkg/util/namespace/namespace_test.go b/pkg/util/namespace/namespace_test.go
index 55233aedd..daa43858e 100644
--- a/pkg/util/namespace/namespace_test.go
+++ b/pkg/util/namespace/namespace_test.go
@@ -60,10 +60,6 @@ func TestIsOpenShiftNamespace(t *testing.T) {
 			namespace: "openshift-operator-lifecycle-manager",
 			want:      true,
 		},
-		{
-			namespace: "openshift-cluster-version",
-			want:      true,
-		},
 	} {
 		t.Run(tt.namespace, func(t *testing.T) {
 			got := IsOpenShiftNamespace(tt.namespace)