identity

Documentation

Overview

Copyright 2026 Microsoft Corporation

Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. You may obtain a copy of the License at

http://www.apache.org/licenses/LICENSE-2.0

Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License.

Copyright 2026 Microsoft Corporation

Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. You may obtain a copy of the License at

http://www.apache.org/licenses/LICENSE-2.0

Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License.

Index

• Constants
• func NewClusterIdentitySyncController(resourcesDBClient corecosmosstorage.ResourcesDBClient, ...) controllerutils.Controller
• func NewFetchDataPlaneOperatorsManagedIdentitiesInfoController(clock utilsclock.PassiveClock, ...) controllerutils.Controller
• func NewFetchMSIIdentitiesInfoController(clock utilsclock.PassiveClock, ...) controllerutils.Controller

Constants

const ClusterIdentitySyncControllerName = "ClusterIdentitySync"

const (
	FetchMSIIdentitiesInfoControllerName = "FetchMSIIdentitiesInfo"
)

Functions

func NewClusterIdentitySyncController

func NewClusterIdentitySyncController(
	resourcesDBClient corecosmosstorage.ResourcesDBClient,
	informers coreinformers.BackendInformers,
	kubeApplierInformers *unionkubeapplierinformers.UnionKubeApplierInformers,
) controllerutils.Controller

NewClusterIdentitySyncController creates a new controller that continuously syncs Identity.UserAssignedIdentities ClientID/PrincipalID from ServiceProviderCluster.Status.MSIManagedIdentities.

It compares Cluster.Identity against the ServiceProviderCluster and updates when ClientID/PrincipalID would change (including nil values returned when an identity does not exist). Map keys in Identity keep the casing from CustomerProperties; ServiceProviderCluster lookups use lowercased resource IDs. Keys remain even when the ServiceProviderCluster does not yet have a matching identity entry. Deleting clusters are skipped.

func NewFetchDataPlaneOperatorsManagedIdentitiesInfoController

func NewFetchDataPlaneOperatorsManagedIdentitiesInfoController(
	clock utilsclock.PassiveClock,
	resourcesDBClient corecosmosstorage.ResourcesDBClient,
	backendInformers coreinformers.BackendInformers,
	smiClientBuilder azureclient.ServiceManagedIdentityClientBuilder,
) controllerutils.Controller

NewFetchDataPlaneOperatorsManagedIdentitiesInfoController creates a cluster-watching controller that keeps ServiceProviderCluster.Status.DataPlaneOperatorsManagedIdentities in sync with the cluster's CustomerProperties data plane operator managed identities.

On each sync it:

1. Reads every operator -> ResourceID entry from Cluster.CustomerProperties.Platform.OperatorsAuthentication.UserAssignedIdentities.DataPlaneOperators and deduplicates by lowercased ResourceID (multiple operators may share one identity).
2. Via needsWork, skips Azure calls when EarliestRecheckTime is still in the future AND the unique ResourceIDs stored on the ServiceProviderCluster still match that desired set. If the desired ResourceIDs have changed, EarliestRecheckTime is ignored so Azure is queried immediately. EarliestRecheckTime is shared across every entry in the Identities map.
3. Otherwise uses the cluster's Service Managed Identity to call Azure UserAssignedIdentitiesClient Get once per unique ResourceID and resolve ClientID and PrincipalID.
4. Rebuilds Status.DataPlaneOperatorsManagedIdentities.Identities as a full desired map keyed by lowercased ResourceID (ResourceID, ClientID, PrincipalID, RetrievalError). Entries that are no longer present on the cluster are pruned. Every desired ResourceID is written into the map: - ParseResourceID of a set key failing returns immediately without writing. That cannot happen for keys produced from ResourceID.String(). - ResourceNotFound keeps the entry, clears ClientID and PrincipalID (nil) and records the error in RetrievalError, so the ServiceProviderCluster still lists the customer-configured identity while signaling that Azure does not currently have it. This is not treated as a sync failure. - Any other Get failure clears ClientID and PrincipalID (nil), records the error in RetrievalError, is accumulated, and processing continues. A successful Get with nil Properties fails the whole sync immediately without writing. - Otherwise ClientID and PrincipalID are written as returned by Azure, including nil or empty values, and RetrievalError is left nil.
5. After every identity is processed without a failing Get, sets EarliestRecheckTime on the in-memory replacement to now plus a jittered interval (including when some identities were ResourceNotFound). When any Get failures were accumulated, EarliestRecheckTime is left nil (cleared) and the accumulated error is returned so needsWork keeps returning true and the workqueue retry re-queries Azure.
6. Writes the ServiceProviderCluster when the desired status differs, then returns any accumulated Get errors. needsWork observes EarliestRecheckTime and the desired-vs-stored ResourceID match from the informer cache, so a wait is introduced only after a successful Replace persists a matching set with a future EarliestRecheckTime. If Replace fails (or hits a precondition failure), the new EarliestRecheckTime is not stored; the workqueue requeues and the next needsWork still sees the previously persisted value (typically nil or already past, or a mismatched identity set), so the controller does not wait out the recheck interval after write failures either.

func NewFetchMSIIdentitiesInfoController

func NewFetchMSIIdentitiesInfoController(
	clock utilsclock.PassiveClock,
	resourcesDBClient corecosmosstorage.ResourcesDBClient,
	backendInformers coreinformers.BackendInformers,
	fpaMIdataplaneClientBuilder azureclient.FPAMIDataplaneClientBuilder,
) controllerutils.Controller

NewFetchMSIIdentitiesInfoController creates a cluster-watching controller that resolves ClientID and PrincipalID for every MSI-based identity of the cluster and persists them on ServiceProviderCluster.Status.MSIManagedIdentities.

These MSI-based identities are the cluster's control plane operator managed identities and the cluster's service managed identity. Their resource IDs come from CustomerProperties.Platform.OperatorsAuthentication.UserAssignedIdentities. This controller fills in ClientID and PrincipalID for each one of them. To do so, it calls the Managed Identities Data Plane service. In environments where the real Managed Identities Data Plane service is not available, a fake implementation of the Managed Identities Data Plane client is used, which always returns the same information and same set of credentials for all requests, independently of which identity is requested. The returned information in those environments is the information associated to the "MI Mock" identity.

On each SyncOnce the controller:

1. Returns immediately when the cluster is deleting or when its Managed Identities Data Plane identity URL is not yet populated.
2. Collects every identity resource ID from CustomerProperties.Platform.OperatorsAuthentication.UserAssignedIdentities (control plane operators and service managed identity), de-duplicating control plane operator identities that share a resource ID.
3. Via needsWork, skips Managed Identities Data Plane calls when ServiceProviderCluster.Status.MSIManagedIdentities.EarliestRecheckTime is still in the future AND the identities stored on the ServiceProviderCluster still match the collected desired set. If the desired identities have changed, EarliestRecheckTime is ignored so the dataplane is queried immediately. The recheck time is shared across every entry in MSIManagedIdentities.ControlPlaneOperatorsIdentities and MSIManagedIdentities.ServiceManagedIdentity.
4. Calls the Managed Identities Data Plane (or the fake client implementation in environments where the real Managed Identities Data Plane service is not available) once with the set of identities.
5. Matches each returned credential by ResourceID (case-insensitive. ARM IDs are case-insensitive and response order is not assumed) and sets ClientID and PrincipalID when the dataplane returns non-empty values. Resource IDs are stored lowercased in the ServiceProviderCluster.
6. On a fully successful dataplane fetch, it sets EarliestRecheckTime on the in-memory replacement to now plus a long jittered interval.
7. Replaces the ServiceProviderCluster document when the resulting document differs from the one that was read. Reads use the informer cache, and the Replace uses the cached document's etag, so a stale cache results in a precondition failure and a requeue rather than clobbering newer data.