Add FPSP to MIWI deny assignment ExcludePrincipals

Azure · Dec 2, 2024 · 90981dd · 90981dd
1 parent 51df910
commit 90981dd
Show file tree

Hide file tree

Showing 2 changed files with 10 additions and 1 deletion.
diff --git a/pkg/cluster/deploybaseresources_additional.go b/pkg/cluster/deploybaseresources_additional.go
@@ -30,6 +30,10 @@ func (m *manager) denyAssignment() *arm.Resource {
 				Type: to.StringPtr(string(mgmtauthorization.ServicePrincipal)),
 			})
 		}
+		excludePrincipals = append(excludePrincipals, mgmtauthorization.Principal{
+			ID:   ptr.To(m.fpServicePrincipalID),
+			Type: ptr.To(string(mgmtauthorization.ServicePrincipal)),
+		})
 	} else {
 		excludePrincipals = append(excludePrincipals, mgmtauthorization.Principal{
 			ID:   &m.doc.OpenShiftCluster.Properties.ServicePrincipalProfile.SPObjectID,

diff --git a/pkg/cluster/deploybaseresources_additional_test.go b/pkg/cluster/deploybaseresources_additional_test.go
@@ -23,7 +23,8 @@ import (
 
 func TestDenyAssignment(t *testing.T) {
 	m := &manager{
-		log: logrus.NewEntry(logrus.StandardLogger()),
+		log:                  logrus.NewEntry(logrus.StandardLogger()),
+		fpServicePrincipalID: "77777777-7777-7777-7777-777777777777",
 	}
 
 	tests := []struct {
@@ -86,6 +87,10 @@ func TestDenyAssignment(t *testing.T) {
 					ID:   to.StringPtr("88888888-8888-8888-8888-888888888888"),
 					Type: to.StringPtr(string(mgmtauthorization.ServicePrincipal)),
 				},
+				{
+					ID:   to.StringPtr("77777777-7777-7777-7777-777777777777"),
+					Type: to.StringPtr(string(mgmtauthorization.ServicePrincipal)),
+				},
 			},
 		},
 	}