ACR_token_changes

[aichanda-png]

Which issue this PR addresses:

https://issues.redhat.com/browse/ARO-22665

What this PR does / why we need it:

We need to use the RP's managed identity credential instead of the 1p credential for ACR token minting in order to fix INT env

How do you know this will function as expected in production?

Its there to fix INT env.

[mociarain]

The diff here seems to include a bunch of commits that are already merged. I think you have brought commits from master into this instead of rebasing. Is this possible?

[aichanda-png]

The diff here seems to include a bunch of commits that are already merged. I think you have brought commits from master into this instead of rebasing. Is this possible?

I’ve now rebased ARO-22665-ACR_token_minting on top of the latest master and force-pushed, so the PR should now only show the ACR token minting changes

[mrWinston]

Looks good! just one small naming issue.

[bennerv]

Can we use env.NewMSIAuthorizer()

[bennerv]

How are we removing the role assignments against the ACR to the 1p application?

[aichanda-png]

How are we removing the role assignments against the ACR to the 1p application?

Thanks, @bennerv
Just to clarify - Marius and I had discussed this earlier, and the plan was not to remove the existing ACR role assignments yet. We first want to verify that the updated RP token-minting flow works end-to-end without breaking anything in the current deployment path.

Once that validation is complete, we’ll handle the cleanup of the old role assignments as a separate step.

Tagging @mrWinston here as well to confirm we're aligned.

[aichanda-png]

@microsoft-github-policy-service agree [company="{your company}"]

@microsoft-github-policy-service agree [company="Red Hat"]

[aichanda-png]

@microsoft-github-policy-service agree [company="Red Hat"]

@microsoft-github-policy-service agree company="Red Hat"