Revamping ARO MIWI docs by diana-sari · Pull Request #956 · rh-mobb/documentation

diana-sari · 2026-06-23T22:51:53Z

Summary

This PR revamps the ARO Managed Identities and Workload Identity Federation guide to align with the current Azure CLI deployment workflow.

Key updates include:

Clarifies the relationship between Azure managed identities and platform workload identity federation.
Documents the Azure CLI 2.84.0 minimum requirement.
Creates the required cluster identity and eight platform identities.
Adds the required Azure RBAC assignments for the cluster and platform identities.
Uses reusable variables and helper functions instead of repeated hardcoded resource paths.
Adds identity and role-assignment validation.
Adds explicit control plane and worker VM sizes.
Adds deployment validation, monitoring, troubleshooting, and cleanup guidance.
Restores and modernizes the one-shot deployment script so customers can keep using the automation path.
Preserves attribution to the original HackMD deployment guide.

The updated procedure was validated with a successful ARO managed-identity deployment.

aws-amplify-us-east-2 · 2026-06-23T22:53:41Z

This pull request is automatically being deployed by Amplify Hosting (learn more).

Access this pull request here: https://pr-956.dqokbbp7eqr35.amplifyapp.com

kmcolli

great job really improving the article, a couple comments and suggestions

kmcolli · 2026-06-24T12:03:17Z

+#!/usr/bin/env bash
+set -euo pipefail


do we need this? we are just doing a copy and paste

thanks yeah that makes sense, will remove the shebang etc

kmcolli · 2026-06-24T12:12:21Z

+```bash
+az login
+az account list --output table
+az account set --subscription "<subscription-name-or-id>"


Separate it out as you can't copy and paste you nee the result from 58 to do what is on line 59
The subscription of '' doesn't exist in cloud 'AzureCloud'.

good catch, let me split them into two steps, and maybe will add some verification command afterwards just to make sure

kmcolli · 2026-06-24T12:14:03Z

+  echo "Pull secret not found: $AZR_PULL_SECRET"
+  exit 1
+}
+```


echo out all variables in a new section?

makes sense, will add it

kmcolli · 2026-06-24T12:17:04Z

-    az provider register -n Microsoft.Authorization --wait
-    az provider register -n Microsoft.ContainerRegistry --wait
-    ```
+## 3. Create the resource group and network


this assumes the vnet is in the same resource group as the cluster is in which many customers aren't doing ... separate out the vnet resource group to it's own as an environment variable

right yeah will do this too

kmcolli · 2026-06-24T12:25:45Z

+```

-az role assignment create --assignee-object-id "$(az identity show --resource-group ${RESOURCE_GROUP} --name ${ARO_CLUSTER_NAME}-ingress --query principalId -o tsv)" --assignee-principal-type ServicePrincipal --role "/subscriptions/${SUBSCRIPTION_ID}/providers/Microsoft.Authorization/roleDefinitions/0336e1d3-7a87-462b-b6db-342b63f7802c" --scope "/subscriptions/${SUBSCRIPTION_ID}/resourceGroups/${VNET_RESOURCE_GROUP}/providers/Microsoft.Network/virtualNetworks/${VNET_NAME}/subnets/${VNET_APP_NODE_SUBNET_NAME}"
+Check DSv5-family usage:


describe more what to expect, the output won't be clear to some customers e.g.
[
{
"Restrictions": [],
"Size": "Standard_D4s_v5"
},
{
"Restrictions": [],
"Size": "Standard_D8s_v5"
}
]

makes sense, will add some notes underneath to explain

kmcolli · 2026-06-24T12:32:05Z

+  --vnet "$AZR_VNET" \
+  --master-subnet "$AZR_MASTER_SUBNET" \
+  --worker-subnet "$AZR_WORKER_SUBNET" \
+  --master-vm-size "Standard_D8s_v5" \


hard coded vm-sizes ... set as environment variables upfront with notes on how to change

yeah good catch, i got impatient last minute and hardcoded this in my test lol

kmcolli · 2026-06-24T12:33:01Z

please put it back, a few customer are using it ... update it with your new suggestions ( if you like :) )

sure will put it back:) with some updates to match the non-automated version one

kmcolli · 2026-06-24T12:33:47Z

-## One-Shot Deployment
+### 6.1 Allow the cluster identity to manage federated credentials

-Download and execute the automated deployment script:


please put instructions back for running the 'automation' script as a few customers are using this

kmcolli · 2026-06-24T12:35:43Z

-{{% /alert %}}
-
-## Access the Cluster
+To submit the operation and monitor it separately, add `--no-wait`.


just include this with the command because if you don't then you can do step 12

Also, add a note about the --debug ... or maybe that goes in troubleshooting

ya makes sense will add --no-wait to the create command

kmcolli · 2026-06-24T13:18:29Z

+
+This guide assumes none is attached to the ARO subnets. When bringing those resources, add the operator role assignments required for each additional network resource before cluster creation.
+
+## Cleanup


there is also the vnet, subnets etc

right yeah i'll rephrase this for clarity

Signed-off-by: dsari-rh <dsari@redhat.com>

revamping miwi doc

047688e

diana-sari assigned kmcolli Jun 23, 2026

diana-sari requested a review from kmcolli June 23, 2026 23:11

diana-sari unassigned kmcolli Jun 23, 2026

kmcolli requested changes Jun 24, 2026

View reviewed changes

diana-sari added 2 commits June 29, 2026 13:37

docs: restore ARO MIWI deployment script

a1a00fb

Signed-off-by: dsari-rh <dsari@redhat.com>

docs: address ARO MIWI review feedback

3dfe5f1

Signed-off-by: dsari-rh <dsari@redhat.com>

diana-sari requested a review from kmcolli June 29, 2026 20:48


		This guide assumes none is attached to the ARO subnets. When bringing those resources, add the operator role assignments required for each additional network resource before cluster creation.

		## Cleanup

Uh oh!

Conversation

diana-sari commented Jun 23, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Uh oh!

aws-amplify-us-east-2 Bot commented Jun 23, 2026

Uh oh!

kmcolli left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

diana-sari commented Jun 23, 2026 •

edited

Loading