nixfiles/home/claude/memory/wsp_32957_pim_migration.md at main

lyrathorpe/nixfiles

Fork 0

Files

T

Emma Thorpe c82c1bef9c

CI / flake (push) Skipped

CI / flake (pull_request) Successful in 1m35s

Details

docs(memory): record the WSP-32957 PIM migration project state

Long-running epic spanning multiple sessions, with several findings that were
expensive to establish and that contradict the Jira epic text — most notably
that production runs in the subscription named "Workspace Platform Technical
Preview", not the one named "Production".

Points at ~/code/WSP-32957-CONTINUATION.md for the detail rather than carrying
it here, following the pattern used for the SIBO project.

2026-08-24 17:51:38 +01:00

3.3 KiB

Raw Permalink Blame History

name, description, metadata

name

description

metadata

wsp-32957-pim-migration

State of the WSP AKS-RBAC-to-PIM migration and AutoPerm decommission, and how to resume it

node_type	type
memory	project

Long-running epic (August 2026) moving WSP's AKS cluster RBAC off AutoPerm Manager-maintained wsp-* groups onto the per-subscription CEO-* Azure PIM groups, then retiring AutoPerm. Epic WSP-32957; on the critical path for Zensar L1 on-call (WSP-32193). Work happens in ~/code/multicluster (terraform/cluster, terraform/cluster-k8s-resources, products/*/environments/*).

Resume from ~/code/WSP-32957-CONTINUATION.md — full state, branch list, verified object IDs, findings and next steps. Jira is the durable record; that file is the index. Keep it updated as work lands (docs-keep-updated).

Landed: WSP-33141 (multicluster PR #1808, merged b047163c) added object-ID inputs — admin_group_oids on cluster, and cluster_user_group_oids / cluster_viewer_group_oids / cluster_superuser_group_oids on cluster-k8s-resources. Supplying IDs replaces the display-name lookup and leaves the data "azuread_group" unread, which is what will let the legacy groups be deleted. Nothing sets them yet, so behaviour is unchanged. Repoint branches for test (WSP-33067) and staging (WSP-33068) are pushed but have no PR — both gated on decisions, not code.

Facts that cost real effort to establish, do not re-derive:

Production runs in fc7af6ae-… (Workspace Platform Technical Preview), not d6d75d07-… (Workspace Platform Production), which holds no clusters. The epic was wrong about this for its whole life and every production CEO-* group name and object ID had to change. Because CEO-* names embed the subscription name, always re-verify object IDs against live Entra rather than trusting the epic table.
Three tenants, not two: 6f4fe054 (prod, prod JP), 335836de (staging, staging JP, test), 3eae2746 (dev). Each wsp-* name is a distinct object in each tenant.
wsp-staging-cluster-admins and wsp-test-cluster-admins are empty, so wsp-owner is the only path to cluster-admin in staging. Never drop it before SuperAdmin-* is proven — hence the staging branch is split into an additive commit and a cutover commit.
No break-glass exists: disableLocalAccounts = True on every cluster; only the deployment SPNs authenticate non-interactively.
Graph PIM-for-Groups is unreadable via az (the CLI's first-party client lacks PrivilegedAccess.Read.AzureADGroup, on both v1.0 and beta). Use the portal or Connect-MgGraph -Scopes PrivilegedAccess.Read.AzureADGroup.

Watch for: the epic gets rewritten by James Weldrake between sessions — re-read the description before acting, and check which child tickets are still live (WSP-33062/33063/33064/33066 were cancelled 2026-08-24, and dev was put out of scope). Verified findings have repeatedly contradicted the epic text (copilot-review-false-positives is the same instinct: check against reality first).

Queued Slack messages and the leaver report live as ~/code/*.txt alongside the continuation file; see the table in it for what has and has not been sent (workflow-review-and-comments — show them before they go out).

3.3 KiB Raw Permalink Blame History

3.3 KiB

Raw Permalink Blame History