Add commontypes/resource-management/v3/managedidentity #15968

TimLovellSmith · 2021-09-08T21:39:59Z

This has models for managed identity as it should be in the PUT request / GET responses for services supporting both SystemAssignedIdentity and UserAssignedIdentity.

Reviewers! You can check validation tools run OK on a PR that actually references these definitions, here:
#15828

MSFT employees can try out our new experience at OpenAPI Hub - one location for using our validation tools and finding your workflow.

Changelog

Add a changelog entry for this PR by answering the following questions:

What's the purpose of the update?
- new service onboarding
- new API version
- update existing version for new feature
- update existing version to fix swagger quality issue in s360
- Other, please clarify
When are you targeting to deploy the new service/feature to public regions? Please provide the date or, if the date is not yet available, the month. N/A
When do you expect to publish the swagger? Please provide date or, the the date is not yet available, the month. N/A
If updating an existing version, please select the specific langauge SDKs and CLIs that must be refreshed after the swagger is published.
- SDK of .NET (need service team to ensure code readiness)
- SDK of Python
- SDK of Java
- SDK of Js
- SDK of Go
- PowerShell
- CLI
- Terraform
- No refresh required for updates in this PR

Contribution checklist:

I commit to follow the Breaking Change Policy of "no breaking changes"
I have reviewed the documentation for the workflow.
Validation tools were run on swagger spec(s) and errors have all been fixed in this PR. How to fix?

If any further question about AME onboarding or validation tools, please view the FAQ.

ARM API Review Checklist

Applicability: ⚠️

If your changes encompass only the following scenarios, you should SKIP this section, as these scenarios do not require ARM review.

Change to data plane APIs

Adding new properties

All removals

Otherwise your PR may be subject to ARM review requirements. Complete the following:

Check this box if any of the following apply to the PR so that label “WaitForARMFeedback” will be added automatically to begin ARM API Review. Failure to comply may result in delays to the manifest.
- Adding a new service
- Adding new API(s)
- Adding a new API version
  -[ ] To review changes efficiently, ensure you copy the existing version into the new directory structure for first commit and then push new changes, including version updates, in separate commits.
Ensure you've reviewed following guidelines including ARM resource provider contract and REST guidelines. Estimated time (4 hours). This is required before you can request review from ARM API Review board.
If you are blocked on ARM review and want to get the PR merged with urgency, please get the ARM oncall for reviews (RP Manifest Approvers team under Azure Resource Manager service) from IcM and reach out to them.

Breaking Change Review Checklist

If any of the following scenarios apply to the PR, request approval from the Breaking Change Review Board as defined in the Breaking Change Policy.

Removing API(s) in a stable version
Removing properties in a stable version
Removing API version(s) in a stable version
Updating API in a stable or public preview version with Breaking Change Validation errors
Updating API(s) in public preview over 1 year (refer to Retirement of Previews)

Action: to initiate an evaluation of the breaking change, create a new intake using the template for breaking changes. Addition details on the process and office hours are on the Breaking change Wiki.

Please follow the link to find more details on PR review process.

…anaged identity for services supporting both SystemAssignedIdentity and UserAssignedIdentity.

openapi-workflow-bot · 2021-09-08T21:40:01Z

Hi, @TimLovellSmith Thanks for your PR. I am workflow bot for review process. Here are some small tips.

Please ensure to do self-check against checklists in first PR comment.

PR assignee is the person auto-assigned and responsible for your current PR reviewing and merging.

For specs comparison cross API versions, Use API Specs Comparison Report Generator

If there is CI failure(s), to fix CI error(s) is mandatory for PR merging; or you need to provide justification in PR comment for explanation. How to fix?

Any feedback about review process or workflow bot, pls contact swagger and tools team. vsswagger@microsoft.com

openapi-workflow-bot · 2021-09-08T21:40:03Z

[Call for Action] To better understand Azure service dev/test scenario, and support Azure service developer better on Swagger and REST API related tests in early phase, please help to fill in with this survey https://aka.ms/SurveyForEarlyPhase. It will take 5 to 10 minutes. If you already complete survey, please neglect this comment. Thanks.

openapi-pipeline-app · 2021-09-08T21:40:04Z

Swagger Validation Report

️️✔️BreakingChange succeeded [Detail] [Expand]

There are no breaking changes.

Compared Swaggers (Based on Oad v0.9.0)
- current:common-types/resource-management/v3 compared with base:common-types/resource-management/v3

️️✔️LintDiff succeeded [Detail] [Expand]

Validation passes for LintDiff.

️️✔️Avocado succeeded [Detail] [Expand]

Validation passes for Avocado.

️️✔️ModelValidation succeeded [Detail] [Expand]

Validation passes for ModelValidation.

️️✔️SemanticValidation succeeded [Detail] [Expand]

Validation passes for SemanticValidation.

️️✔️Cross-Version Breaking Changes succeeded [Detail] [Expand]

There are no breaking changes.

️️✔️CredScan succeeded [Detail] [Expand]

There is no credential detected.

️️✔️[Staging] SDK Track2 Validation succeeded [Detail] [Expand]

Validation passes for SDKTrack2Validation

️️✔️[Staging] PrettierCheck succeeded [Detail] [Expand]

Validation passes for PrettierCheck.

️️✔️[Staging] SpellCheck succeeded [Detail] [Expand]

Validation passes for SpellCheck.

️️✔️[Staging] Lint(RPaaS) succeeded [Detail] [Expand]

Validation passes for Lint(RPaaS).

_{Posted by Swagger Pipeline | How to fix these errors?}

openapi-pipeline-app · 2021-09-08T21:40:04Z

Swagger Generation Artifacts

️️✔️[Staging] ApiDocPreview succeeded [Detail] [Expand]

 Please click here to preview with your @microsoft account.

️️✔️[Staging] SDK Breaking Change Tracking succeeded [Detail] [Expand]

Breaking Changes Tracking

_{Posted by Swagger Pipeline | How to fix these errors?}

TimLovellSmith · 2021-09-10T00:01:46Z

@akning-ms Look OK to merge?

akning-ms · 2021-09-10T03:32:23Z

Thanks @TimLovellSmith, for contribute this PR. few questions:

should we leave previous identify as it in v3:

azure-rest-api-specs/specification/common-types/resource-management/v3/types.json

Line 233 in 33435f8

"Identity": {

or at least add None?
Notice there is some service only support SystemAssigned. not UserAssigned, can they still use common type?

TimLovellSmith · 2021-09-10T04:12:55Z

@akning-ms We can't really add None to the previous identity definition because it has the enumeration "modelAsString": false and so it is a breaking change. :-(

Services that only support SystemAssigned could use the common type that understands both identity types. But, if they choose to do this then the RP MUST explicitly reject all PUT and PATCH requests with userAssignedIdentity while it is unsupported. The main reason RPs might prefer doing it this way would be to design for compatibility with future api-versions, where they plan to support both systemAssigned or userAssigned identity. (Same deal for services which only support UserAssigned today but might support SystemAssinged in the future.)

Of course, I hope that all services that support SystemAssigned or UserAssigned could use the new common type definitions in their future api-versions.

The best alternatives to using the new common type are

keep doing whatever you already have in your last api-version, to minimize churn, this would be a sensible option for services that don't support both identity types, and e.g. only support userAssignedIdentity, or support systemAssignedIdentity but also the enumeration value 'None'.
use the existing "identity" type in "v3/types.json". System assigned identity can be removed using their REST API by sending PUT requests that delete the whole identity property, if that scenario is required.

By the way does everyone like the definition names here? I have started to worry that I might not have put enough thought into these ones:
"ManagedServiceIdentity"
"ManagedServiceIdentityType"

/cc @pilor

TimLovellSmith · 2021-09-10T04:19:58Z

Updated answer: given the authoring rule

'An OpenAPI(Swagger) spec MUST NOT define operations or properties or parameters for functionalities that are not currently supported by the service in the given api-version. The primary goal of the spec is that it MUST correctly and completely represent the underlying REST API. For example, NetworkInterface.ipConfigurations is described as a collection. However, it does not support adding more than one IP configuration'

then any service not actually supporting both should NOT use the type which appears to support both - until it actually does.

TimLovellSmith · 2021-09-10T04:36:13Z

Further updated answer: looks like the latest requirements are that all MSI-enabled RPs must support identity type "None".

This seems like a good reason to create an updated identity type definition, and give it a different name (SystemAssignedServiceIdentity and an enum SystemAssignedServiceIdentityType?), or a new version of 'identity' (v4), so that we have another pit-of-success type, to point services towards using, in their new api-versions.

TimLovellSmith · 2021-09-10T04:47:00Z

One more self-review feedback 'type' should be a required property, right?

…ch supports 'None', since that is required going forward. Also make the 'type' property required, since omitting it from the request would not be clear in intent.

TimLovellSmith · 2021-09-14T03:59:40Z

@pilor Could I get a sanity check on the new changes too?
@akning-ms Do my answers above look OK? Anything else we should consider to make the APIs better going forward?

akning-ms · 2021-09-14T07:40:10Z

@pilor Chris Eggert FTE Could I get a sanity check on the new changes too?
@akning-ms Arthur Ning FTE Do my answers above look OK? Anything else we should consider to make the APIs better going forward?

Yes. saw you already added SystemAssignedServiceIdentityType, so the PR LGTM. if Chris confirmed your question. I can merge it.
BTW, v3 is just created recently. roughly check. there is only RP is using v3

pilor · 2021-09-14T17:32:06Z

Yes, looks good

TimLovellSmith · 2021-09-14T21:59:37Z

@akning-ms Looks like we are ready to merge. Yes v3 is pretty new.

I imagine that we can get to a more consistent user-friendly SDK fast enough by encouraging as many RPs as possible to use the latest (now v3) common types in their current and future PRs for new api-versions...

I'd say its initially OK to accept exception requests for concerns about churn or compatibility - but then to gradually be less permissive, as we become are more confident that the definitions are good, and enough time has been allowed to address other issues or consolidate changes to minimize perception of churn.

TimLovellSmith · 2021-09-15T17:02:22Z

@akning-ms Thanks for the feedback and merge!

TimLovellSmith · 2021-09-15T17:02:38Z

@pilor Thanks for the review!

* Add commontypes/resource-management/v3/managedidentity which models managed identity for services supporting both SystemAssignedIdentity and UserAssignedIdentity. * Add a canonical SystemAssignedServiceIdentityType type definition which supports 'None', since that is required going forward. Also make the 'type' property required, since omitting it from the request would not be clear in intent. * Add principalId and tenantId.

Add commontypes/resource-management/v3/managedidentity which models m…

4369a55

…anaged identity for services supporting both SystemAssignedIdentity and UserAssignedIdentity.

openapi-assignment-bot bot assigned akning-ms Sep 8, 2021

TimLovellSmith requested a review from pilor September 9, 2021 18:57

pilor approved these changes Sep 9, 2021

View reviewed changes

pilor added the ARMSignedOff <valid label in PR review process>add this label when ARM approve updates after review label Sep 9, 2021

TimLovellSmith added 2 commits September 9, 2021 21:49

Add a canonical SystemAssignedServiceIdentityType type definition whi…

0bf870d

…ch supports 'None', since that is required going forward. Also make the 'type' property required, since omitting it from the request would not be clear in intent.

Add principalId and tenantId.

1baa770

akning-ms merged commit e16ce2d into main Sep 15, 2021

JackTn deleted the add-commontypes-managedidentity branch June 16, 2022 00:47

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Add commontypes/resource-management/v3/managedidentity #15968

Add commontypes/resource-management/v3/managedidentity #15968

TimLovellSmith commented Sep 8, 2021

openapi-workflow-bot bot commented Sep 8, 2021

openapi-workflow-bot bot commented Sep 8, 2021

openapi-pipeline-app bot commented Sep 8, 2021 •

edited

Loading

openapi-pipeline-app bot commented Sep 8, 2021 •

edited

Loading

Breaking Changes Tracking

TimLovellSmith commented Sep 10, 2021

akning-ms commented Sep 10, 2021

TimLovellSmith commented Sep 10, 2021 •

edited

Loading

TimLovellSmith commented Sep 10, 2021 •

edited

Loading

TimLovellSmith commented Sep 10, 2021 •

edited

Loading

TimLovellSmith commented Sep 10, 2021

TimLovellSmith commented Sep 14, 2021

akning-ms commented Sep 14, 2021

pilor commented Sep 14, 2021

TimLovellSmith commented Sep 14, 2021

TimLovellSmith commented Sep 15, 2021

TimLovellSmith commented Sep 15, 2021

Add commontypes/resource-management/v3/managedidentity #15968

Add commontypes/resource-management/v3/managedidentity #15968

Conversation

TimLovellSmith commented Sep 8, 2021

Changelog

Contribution checklist:

ARM API Review Checklist

Breaking Change Review Checklist

openapi-workflow-bot bot commented Sep 8, 2021

openapi-workflow-bot bot commented Sep 8, 2021

openapi-pipeline-app bot commented Sep 8, 2021 • edited Loading

Swagger Validation Report

openapi-pipeline-app bot commented Sep 8, 2021 • edited Loading

Swagger Generation Artifacts

Breaking Changes Tracking

TimLovellSmith commented Sep 10, 2021

akning-ms commented Sep 10, 2021

TimLovellSmith commented Sep 10, 2021 • edited Loading

TimLovellSmith commented Sep 10, 2021 • edited Loading

TimLovellSmith commented Sep 10, 2021 • edited Loading

TimLovellSmith commented Sep 10, 2021

TimLovellSmith commented Sep 14, 2021

akning-ms commented Sep 14, 2021

pilor commented Sep 14, 2021

TimLovellSmith commented Sep 14, 2021

TimLovellSmith commented Sep 15, 2021

TimLovellSmith commented Sep 15, 2021

openapi-pipeline-app bot commented Sep 8, 2021 •

edited

Loading

openapi-pipeline-app bot commented Sep 8, 2021 •

edited

Loading

TimLovellSmith commented Sep 10, 2021 •

edited

Loading

TimLovellSmith commented Sep 10, 2021 •

edited

Loading

TimLovellSmith commented Sep 10, 2021 •

edited

Loading