use sufficient identity roles for conformance tests

[jackfrancis]

What type of PR is this?

/kind cleanup

What this PR does / why we need it:

This PR configures the identity used by kind to possess only the sufficient role asssignments needed to perform all tests.

Which issue(s) this PR fixes (optional, in fixes #<issue number>(, fixes #<issue_number>, ...) format, will close the issue(s) when PR gets merged):
Fixes #

Special notes for your reviewer:

• cherry-pick candidate

TODOs:

• squashed commits
• includes documentation
• adds unit tests

Release note:

NONE

[nojnhuh]

/lgtm
/approve
/hold for conformance tests

[k8s-ci-robot]

LGTM label has been added.

Git tree hash: 97fa0dea3430fbe63d0f67371a44d2e3eb3c8948

[k8s-ci-robot]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: nojnhuh

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

• OWNERS [nojnhuh]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[codecov]

Codecov Report

All modified and coverable lines are covered by tests ✅

Project coverage is 51.14%. Comparing base (711d861) to head (5d736e8).
Report is 4 commits behind head on main.

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #5060   +/-   ##
=======================================
  Coverage   51.14%   51.14%           
=======================================
  Files         274      274           
  Lines       24669    24669           
=======================================
  Hits        12617    12617           
  Misses      11264    11264           
  Partials      788      788           

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

[nojnhuh]

/retest

[nojnhuh]

/retest

[nojnhuh]

@jackfrancis The windows-custom-builds job should be more stable now. Can you please try removing the "Storage Account Contributor" role again?

[nojnhuh]

/retest

[nojnhuh]

/retest

[nojnhuh]

The cluster-autoscaler e2e tests need permission to create role assignments (for workload identity auth from CAS) which Contributor doesn't have, but I think that gap can be filled with the "Role Based Access Control Administrator" role.

[nojnhuh]

Just verified cluster-autoscaler tests using an identity with Contributor + RBAC Admin passes for me locally.

[jackfrancis]

ACK I couldn't remember why we might need the identity to have role assignment create perms, but now I do.

I think adding an add'l role assignment (Contributor + RBAC) is the bigger downside compared to the slight add'l privileges that Owner vs Contributor carries given that we actually need the most interesting part of the delta (the ability to create new role assignments).

• https://learn.microsoft.com/en-us/azure/role-based-access-control/built-in-roles

[nojnhuh]

FWIW I think Contributor + RBAC Admin has slightly fewer perms than Owner, i.e. it would not have the notActions here (aside from the ones granted by RBAC Admin):

{
  "assignableScopes": [
    "/"
  ],
  "description": "Grants full access to manage all resources, but does not allow you to assign roles in Azure RBAC, manage assignments in Azure Blueprints, or share image galleries.",
  "id": "/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c",
  "name": "b24988ac-6180-42a0-ab88-20f7382dd24c",
  "permissions": [
    {
      "actions": [
        "*"
      ],
      "notActions": [
        "Microsoft.Authorization/*/Delete",
        "Microsoft.Authorization/*/Write",
        "Microsoft.Authorization/elevateAccess/Action",
        "Microsoft.Blueprint/blueprintAssignments/write",
        "Microsoft.Blueprint/blueprintAssignments/delete",
        "Microsoft.Compute/galleries/share/action",
        "Microsoft.Purview/consents/write",
        "Microsoft.Purview/consents/delete"
      ],
      "dataActions": [],
      "notDataActions": []
    }
  ],
  "roleName": "Contributor",
  "roleType": "BuiltInRole",
  "type": "Microsoft.Authorization/roleDefinitions"
}

The elevateAccess one in particular might be worth avoiding if possible.

[jackfrancis]

fair, testing our new trifecta now

[nojnhuh]

/lgtm

will leave the hold for tests

[k8s-ci-robot]

LGTM label has been added.

Git tree hash: 2283b0daf02a5210b3de04372b3723eb611cf1f0

[jackfrancis]

note that commits are not squashed

[nojnhuh]

/retest

[jackfrancis]

/label tide/merge-method-squash

[nojnhuh]

/hold cancel

[nojnhuh]

This job has flaked the same way recently a few times: https://storage.googleapis.com/k8s-triage/index.html?pr=1&text=Job%20default%2Fcurl-to

/retest

[jackfrancis]

/cherry-pick release-1.16

[k8s-infra-cherrypick-robot]

@jackfrancis: new pull request created: #5065

In response to this:

/cherry-pick release-1.16

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.