---
name: wsp-32957-pim-migration
description: State of the WSP AKS-RBAC-to-PIM migration and AutoPerm decommission, and how to resume it
metadata:
  node_type: memory
  type: project
---

Long-running epic (August 2026) moving WSP's AKS cluster RBAC off **AutoPerm
Manager**-maintained `wsp-*` groups onto the per-subscription **`CEO-*` Azure PIM**
groups, then retiring AutoPerm. Epic **WSP-32957**; on the critical path for Zensar
L1 on-call (WSP-32193). Work happens in **`~/code/multicluster`**
(`terraform/cluster`, `terraform/cluster-k8s-resources`, `products/*/environments/*`).

**Resume from `~/code/WSP-32957-CONTINUATION.md`** — full state, branch list,
verified object IDs, findings and next steps. Jira is the durable record; that file
is the index. Keep it updated as work lands ([[docs-keep-updated]]).

**Landed:** WSP-33141 (multicluster PR #1808, merged `b047163c`) added object-ID
inputs — `admin_group_oids` on `cluster`, and `cluster_user_group_oids` /
`cluster_viewer_group_oids` / `cluster_superuser_group_oids` on
`cluster-k8s-resources`. Supplying IDs _replaces_ the display-name lookup and leaves
the `data "azuread_group"` unread, which is what will let the legacy groups be
deleted. Nothing sets them yet, so behaviour is unchanged. Repoint branches for test
(WSP-33067) and staging (WSP-33068) are pushed but have **no PR** — both gated on
decisions, not code.

**Facts that cost real effort to establish, do not re-derive:**

- **Production runs in `fc7af6ae-…` (_Workspace Platform Technical Preview_), not
  `d6d75d07-…` (_Workspace Platform Production_)**, which holds no clusters. The
  epic was wrong about this for its whole life and every production `CEO-*` group
  name and object ID had to change. Because `CEO-*` names embed the subscription
  name, **always re-verify object IDs against live Entra rather than trusting the
  epic table.**
- **Three tenants**, not two: `6f4fe054` (prod, prod JP), `335836de` (staging,
  staging JP, test), `3eae2746` (dev). Each `wsp-*` name is a distinct object in
  each tenant.
- `wsp-staging-cluster-admins` and `wsp-test-cluster-admins` are **empty**, so
  `wsp-owner` is the _only_ path to `cluster-admin` in staging. Never drop it before
  `SuperAdmin-*` is proven — hence the staging branch is split into an additive
  commit and a cutover commit.
- **No break-glass exists**: `disableLocalAccounts = True` on every cluster; only the
  deployment SPNs authenticate non-interactively.
- Graph **PIM-for-Groups is unreadable via `az`** (the CLI's first-party client lacks
  `PrivilegedAccess.Read.AzureADGroup`, on both `v1.0` and `beta`). Use the portal or
  `Connect-MgGraph -Scopes PrivilegedAccess.Read.AzureADGroup`.

**Watch for:** the epic gets rewritten by James Weldrake between sessions — re-read
the description before acting, and check which child tickets are still live
(WSP-33062/33063/33064/33066 were cancelled 2026-08-24, and dev was put out of
scope). Verified findings have repeatedly contradicted the epic text
([[copilot-review-false-positives]] is the same instinct: check against reality
first).

Queued Slack messages and the leaver report live as `~/code/*.txt` alongside the
continuation file; see the table in it for what has and has not been sent
([[workflow-review-and-comments]] — show them before they go out).