From c82c1bef9c15424a1f1ba64c1494d7a7eab635b4 Mon Sep 17 00:00:00 2001 From: Emma Thorpe Date: Mon, 24 Aug 2026 17:51:38 +0100 Subject: [PATCH] docs(memory): record the WSP-32957 PIM migration project state MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Long-running epic spanning multiple sessions, with several findings that were expensive to establish and that contradict the Jira epic text — most notably that production runs in the subscription named "Workspace Platform Technical Preview", not the one named "Production". Points at ~/code/WSP-32957-CONTINUATION.md for the detail rather than carrying it here, following the pattern used for the SIBO project. --- home/claude/memory/MEMORY.md | 1 + home/claude/memory/wsp_32957_pim_migration.md | 58 +++++++++++++++++++ 2 files changed, 59 insertions(+) create mode 100644 home/claude/memory/wsp_32957_pim_migration.md diff --git a/home/claude/memory/MEMORY.md b/home/claude/memory/MEMORY.md index d7ca594..9acb154 100644 --- a/home/claude/memory/MEMORY.md +++ b/home/claude/memory/MEMORY.md @@ -15,3 +15,4 @@ - [Dev clusters disposable](dev_clusters_disposable.md) — Lyra's dev clusters are recreatable; mutate/break freely, no confirmation needed - [Nix shell tooling](nix_shell_tooling.md) — any nixpkgs tool runs ad hoc via `nix run`/`nix shell nixpkgs#`; a missing command is never a dead end - [WSP local build and test](wsp_local_build_and_test.md) — core-services-cloud on this box: dotnet via nix, artifactory creds from `~/.artifactoryenv` sourced per command, how to tell auth failure from a code failure +- [WSP-32957 PIM migration](wsp_32957_pim_migration.md) — AKS RBAC to PIM + AutoPerm decommission; prod is in the Technical Preview subscription, three tenants; resume via `~/code/WSP-32957-CONTINUATION.md` diff --git a/home/claude/memory/wsp_32957_pim_migration.md b/home/claude/memory/wsp_32957_pim_migration.md new file mode 100644 index 0000000..765eddf --- /dev/null +++ b/home/claude/memory/wsp_32957_pim_migration.md @@ -0,0 +1,58 @@ +--- +name: wsp-32957-pim-migration +description: State of the WSP AKS-RBAC-to-PIM migration and AutoPerm decommission, and how to resume it +metadata: + node_type: memory + type: project +--- + +Long-running epic (August 2026) moving WSP's AKS cluster RBAC off **AutoPerm +Manager**-maintained `wsp-*` groups onto the per-subscription **`CEO-*` Azure PIM** +groups, then retiring AutoPerm. Epic **WSP-32957**; on the critical path for Zensar +L1 on-call (WSP-32193). Work happens in **`~/code/multicluster`** +(`terraform/cluster`, `terraform/cluster-k8s-resources`, `products/*/environments/*`). + +**Resume from `~/code/WSP-32957-CONTINUATION.md`** — full state, branch list, +verified object IDs, findings and next steps. Jira is the durable record; that file +is the index. Keep it updated as work lands ([[docs-keep-updated]]). + +**Landed:** WSP-33141 (multicluster PR #1808, merged `b047163c`) added object-ID +inputs — `admin_group_oids` on `cluster`, and `cluster_user_group_oids` / +`cluster_viewer_group_oids` / `cluster_superuser_group_oids` on +`cluster-k8s-resources`. Supplying IDs _replaces_ the display-name lookup and leaves +the `data "azuread_group"` unread, which is what will let the legacy groups be +deleted. Nothing sets them yet, so behaviour is unchanged. Repoint branches for test +(WSP-33067) and staging (WSP-33068) are pushed but have **no PR** — both gated on +decisions, not code. + +**Facts that cost real effort to establish, do not re-derive:** + +- **Production runs in `fc7af6ae-…` (_Workspace Platform Technical Preview_), not + `d6d75d07-…` (_Workspace Platform Production_)**, which holds no clusters. The + epic was wrong about this for its whole life and every production `CEO-*` group + name and object ID had to change. Because `CEO-*` names embed the subscription + name, **always re-verify object IDs against live Entra rather than trusting the + epic table.** +- **Three tenants**, not two: `6f4fe054` (prod, prod JP), `335836de` (staging, + staging JP, test), `3eae2746` (dev). Each `wsp-*` name is a distinct object in + each tenant. +- `wsp-staging-cluster-admins` and `wsp-test-cluster-admins` are **empty**, so + `wsp-owner` is the _only_ path to `cluster-admin` in staging. Never drop it before + `SuperAdmin-*` is proven — hence the staging branch is split into an additive + commit and a cutover commit. +- **No break-glass exists**: `disableLocalAccounts = True` on every cluster; only the + deployment SPNs authenticate non-interactively. +- Graph **PIM-for-Groups is unreadable via `az`** (the CLI's first-party client lacks + `PrivilegedAccess.Read.AzureADGroup`, on both `v1.0` and `beta`). Use the portal or + `Connect-MgGraph -Scopes PrivilegedAccess.Read.AzureADGroup`. + +**Watch for:** the epic gets rewritten by James Weldrake between sessions — re-read +the description before acting, and check which child tickets are still live +(WSP-33062/33063/33064/33066 were cancelled 2026-08-24, and dev was put out of +scope). Verified findings have repeatedly contradicted the epic text +([[copilot-review-false-positives]] is the same instinct: check against reality +first). + +Queued Slack messages and the leaver report live as `~/code/*.txt` alongside the +continuation file; see the table in it for what has and has not been sent +([[workflow-review-and-comments]] — show them before they go out).