docs(ci): add operational runbooks for non-migratable Entra ID scripts - #6171
docs(ci): add operational runbooks for non-migratable Entra ID scripts#6171Ghazi Alchammat (galchammat) wants to merge 2 commits into
Conversation
Adds SOPs for the three groups of Entra ID management scripts that cannot be migrated to Bicep due to cross-tenant operations, external secret stores, or imperative credential rotation. Refs: ARO-27252, AROSLSRE-1353 Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
|
[APPROVALNOTIFIER] This PR is NOT APPROVED This pull-request has been approved by: galchammat The full list of commands accepted by this bot can be found here. DetailsNeeds approval from an approver in each of these files:Approvers can indicate their approval by writing |
|
Skipping CI for Draft Pull Request. |
1 similar comment
|
Skipping CI for Draft Pull Request. |
Ghazi Alchammat (galchammat)
changed the title
|
/test all |
There was a problem hiding this comment.
Pull request overview
This PR adds operational SOP documentation under docs/sops/ for Entra ID management scripts that remain imperative (cross-tenant operations, external secret stores, and credential rotation) and therefore aren’t candidates for declarative Bicep migration.
Changes:
- Added SOP for CI bot Entra client secret provisioning into Azure Key Vault.
- Added SOP for Release Bot MSFT Test tenant credential creation/rotation with HashiCorp Vault integration.
- Added SOP for tenant-quota collector service principal creation and secret rotation workflows.
Reviewed changes
Copilot reviewed 3 out of 3 changed files in this pull request and generated 3 comments.
| File | Description |
|---|---|
| docs/sops/tenant-quota-service-principals.md | New runbook for creating/rotating tenant-quota collector SPs and secrets across tenants. |
| docs/sops/release-bot-msft-test-tenant.md | New runbook for Release Bot MSFT Test tenant setup and Vault-backed credential rotation. |
| docs/sops/ci-bot-secret-provisioning.md | New runbook for manual backfill/provisioning of CI bot secrets into Key Vault. |
|
Ghazi Alchammat (@galchammat): The following test failed, say
Full PR test history. Your PR dashboard. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here. |
… script update Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
|
Copilot review |
AROSLSRE-1353 | ARO-27252
What
Adds three SOPs in
docs/sops/documenting the Entra ID management scripts that cannot be migrated to declarative Bicep:Why
The ARO-27252 assessment classified these scripts as "needs a different approach" due to cross-tenant operations, external secret stores (HashiCorp Vault), and imperative credential rotation. They remain the active management path and had no operational documentation.
Testing
Docs only -- no code changes. Verified all script paths and commands reference existing files.
PR Checklist
🤖 Generated with Claude Code