From e38d1457a0e2051d7aa050d60e80eb46704db711 Mon Sep 17 00:00:00 2001 From: Tongyao Si Date: Tue, 26 Jul 2022 19:23:06 +0800 Subject: [PATCH] {AKS} Check inherited permission when granting permission to cluster identity (#23178) --- .../cli/command_modules/acs/_roleassignments.py | 13 +++++++++---- 1 file changed, 9 insertions(+), 4 deletions(-) diff --git a/src/azure-cli/azure/cli/command_modules/acs/_roleassignments.py b/src/azure-cli/azure/cli/command_modules/acs/_roleassignments.py index 803799acaf9..afd357bbe6e 100644 --- a/src/azure-cli/azure/cli/command_modules/acs/_roleassignments.py +++ b/src/azure-cli/azure/cli/command_modules/acs/_roleassignments.py @@ -277,13 +277,18 @@ def subnet_role_assignment_exists(cmd, scope): def ensure_cluster_identity_permission_on_kubelet_identity(cmd, cluster_identity_object_id, scope): factory = get_auth_management_client(cmd.cli_ctx, scope) assignments_client = factory.role_assignments + cluster_identity_object_id = cluster_identity_object_id.lower() + scope = scope.lower() - for i in assignments_client.list_for_scope(scope=scope, filter="atScope()"): - if i.scope.lower() != scope.lower(): - continue + # list all assignments of the target identity (scope) that assigned to the cluster identity + filter_query = "atScope() and assignedTo('{}')".format(cluster_identity_object_id) + for i in assignments_client.list_for_scope(scope=scope, filter=filter_query): if not i.role_definition_id.lower().endswith(CONST_MANAGED_IDENTITY_OPERATOR_ROLE_ID): continue - if i.principal_id.lower() != cluster_identity_object_id.lower(): + if i.principal_id.lower() != cluster_identity_object_id: + continue + if not scope.startswith(i.scope.lower()): + # atScope() should return the assignments in subscription / resource group / resource level continue # already assigned return