Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Support Granular Permission for Subnet for ARO SPNs during install #1407

Open
uday31in opened this issue Mar 22, 2021 · 0 comments
Open

Support Granular Permission for Subnet for ARO SPNs during install #1407

uday31in opened this issue Mar 22, 2021 · 0 comments

Comments

@uday31in
Copy link
Member

Instead or checking for vNet scope for Network contributor role, support subnet level scope to allow fine grained permission for cluster install.

Microsoft.Network/virtualNetworks/subnets/*

Risk with vNet level permission is when multiple cluster operator share the same vNet, all of them needed to be a contributor and have higher privileges then what is necessary.

ARO-RP/python/az/aro/azext_aro/custom.py

Line 330 in 2fac92d

return get_network_resources(cli_ctx, worker_subnets | {master_subnet}, vnet)

@uday31in uday31in changed the title Support Provider Granular Permission for ARO SPNs Support Granular Permission for Subnet for ARO SPNs during install Mar 22, 2021
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
1 participant
@uday31in