59 lines
3.3 KiB
Markdown
59 lines
3.3 KiB
Markdown
|
---
|
||
|
|
name: wsp-32957-pim-migration
|
||
|
|
description: State of the WSP AKS-RBAC-to-PIM migration and AutoPerm decommission, and how to resume it
|
||
|
|
metadata:
|
||
|
|
node_type: memory
|
||
|
|
type: project
|
||
|
|
---
|
||
|
|
|
||
|
|
Long-running epic (August 2026) moving WSP's AKS cluster RBAC off **AutoPerm
|
||
|
|
Manager**-maintained `wsp-*` groups onto the per-subscription **`CEO-*` Azure PIM**
|
||
|
|
groups, then retiring AutoPerm. Epic **WSP-32957**; on the critical path for Zensar
|
||
|
|
L1 on-call (WSP-32193). Work happens in **`~/code/multicluster`**
|
||
|
|
(`terraform/cluster`, `terraform/cluster-k8s-resources`, `products/*/environments/*`).
|
||
|
|
|
||
|
|
**Resume from `~/code/WSP-32957-CONTINUATION.md`** — full state, branch list,
|
||
|
|
verified object IDs, findings and next steps. Jira is the durable record; that file
|
||
|
|
is the index. Keep it updated as work lands ([[docs-keep-updated]]).
|
||
|
|
|
||
|
|
**Landed:** WSP-33141 (multicluster PR #1808, merged `b047163c`) added object-ID
|
||
|
|
inputs — `admin_group_oids` on `cluster`, and `cluster_user_group_oids` /
|
||
|
|
`cluster_viewer_group_oids` / `cluster_superuser_group_oids` on
|
||
|
|
`cluster-k8s-resources`. Supplying IDs _replaces_ the display-name lookup and leaves
|
||
|
|
the `data "azuread_group"` unread, which is what will let the legacy groups be
|
||
|
|
deleted. Nothing sets them yet, so behaviour is unchanged. Repoint branches for test
|
||
|
|
(WSP-33067) and staging (WSP-33068) are pushed but have **no PR** — both gated on
|
||
|
|
decisions, not code.
|
||
|
|
|
||
|
|
**Facts that cost real effort to establish, do not re-derive:**
|
||
|
|
|
||
|
|
- **Production runs in `fc7af6ae-…` (_Workspace Platform Technical Preview_), not
|
||
|
|
`d6d75d07-…` (_Workspace Platform Production_)**, which holds no clusters. The
|
||
|
|
epic was wrong about this for its whole life and every production `CEO-*` group
|
||
|
|
name and object ID had to change. Because `CEO-*` names embed the subscription
|
||
|
|
name, **always re-verify object IDs against live Entra rather than trusting the
|
||
|
|
epic table.**
|
||
|
|
- **Three tenants**, not two: `6f4fe054` (prod, prod JP), `335836de` (staging,
|
||
|
|
staging JP, test), `3eae2746` (dev). Each `wsp-*` name is a distinct object in
|
||
|
|
each tenant.
|
||
|
|
- `wsp-staging-cluster-admins` and `wsp-test-cluster-admins` are **empty**, so
|
||
|
|
`wsp-owner` is the _only_ path to `cluster-admin` in staging. Never drop it before
|
||
|
|
`SuperAdmin-*` is proven — hence the staging branch is split into an additive
|
||
|
|
commit and a cutover commit.
|
||
|
|
- **No break-glass exists**: `disableLocalAccounts = True` on every cluster; only the
|
||
|
|
deployment SPNs authenticate non-interactively.
|
||
|
|
- Graph **PIM-for-Groups is unreadable via `az`** (the CLI's first-party client lacks
|
||
|
|
`PrivilegedAccess.Read.AzureADGroup`, on both `v1.0` and `beta`). Use the portal or
|
||
|
|
`Connect-MgGraph -Scopes PrivilegedAccess.Read.AzureADGroup`.
|
||
|
|
|
||
|
|
**Watch for:** the epic gets rewritten by James Weldrake between sessions — re-read
|
||
|
|
the description before acting, and check which child tickets are still live
|
||
|
|
(WSP-33062/33063/33064/33066 were cancelled 2026-08-24, and dev was put out of
|
||
|
|
scope). Verified findings have repeatedly contradicted the epic text
|
||
|
|
([[copilot-review-false-positives]] is the same instinct: check against reality
|
||
|
|
first).
|
||
|
|
|
||
|
|
Queued Slack messages and the leaver report live as `~/code/*.txt` alongside the
|
||
|
|
continuation file; see the table in it for what has and has not been sent
|
||
|
|
([[workflow-review-and-comments]] — show them before they go out).
|