Azure / Azure/azure-rest-api-specs

[BUG]Microsoft.RedHatOpenShift 2025-07-25 should model `identity` as UserAssigned only for `openShiftClusters`

Open Beginner friendly
#43,540 0 comments 0 reactions 0 assignees View on GitHub
bug
Dominant language
TypeSpec
Stars
3.1k
Forks
5.9k
Avg merge
3d 2h
Merged PRs (30d)
424

Description

### API Spec link

https://github.com/Azure/azure-rest-api-specs/blob/5a45c68db967ced0736a2f91a74774a65771dadc/specification/redhatopenshift/resource-manager/Microsoft.RedHatOpenShift/OpenShiftClusters/stable/2025-07-25/redhatopenshift.json#L1000-L1004

### API Spec version

2025-07-25

### Describe the bug

The `2025-07-25` stable swagger for `Microsoft.RedHatOpenShift/openShiftClusters` appears to expose a broader managed identity shape than the API actually accepts, API only supports `UserAssigned`, otherwise will return 400 Bad Request error
https://github.com/Azure/azure-rest-api-specs/blob/5a45c68db967ced0736a2f91a74774a65771dadc/specification/common-types/resource-management/v6/managedidentity.json#L41-L54

### Expected behavior

the swagger should only include UserAssigned as the API actually accepts

### Actual behavior

the swagger include below identity types:
"None",
"SystemAssigned",
"UserAssigned",
"SystemAssigned,UserAssigned"

### Reproduction Steps
```
repro_id="aro43540$(date +%H%M%S)"
rg_name="$repro_id-rg"
cluster_name="$repro_id"
location="australiaeast"
sub_id="$(az account show --query id -o tsv | tr -d '\r\n')"

az group create --name "$rg_name" --location "$location"

az identity create \
--resource-group "$rg_name" \
--name "$repro_id-operator" \
--location "$location"

az network vnet create \
--resource-group "$rg_name" \
--name "$repro_id-vnet" \
--location "$location" \
--address-prefixes 10.0.0.0/22 \
--subnet-name master \
--subnet-prefixes 10.0.0.0/23

az network vnet subnet create \
--resource-group "$rg_name" \
--vnet-name "$repro_id-vnet" \
--name worker \
--address-prefixes 10.0.2.0/23

operator_identity_id="$(az identity show --resource-group "$rg_name" --name "$repro_id-operator" --query id -o tsv | tr -d '\r\n')"
master_subnet_id="$(az network vnet subnet show --resource-group "$rg_name" --vnet-name "$repro_id-vnet" --name master --query id -o tsv | tr -d '\r\n')"
worker_subnet_id="$(az network vnet subnet show --resource-group "$rg_name" --vnet-name "$repro_id-vnet" --name worker --query id -o tsv | tr -d '\r\n')"
cluster_domain="$cluster_name.aro-example.com"
cluster_rg_id="/subscriptions/$sub_id/resourceGroups/aro-$cluster_domain-$location"

az rest \
--method put \
--url "/subscriptions/$sub_id/resourceGroups/$rg_name/providers/Microsoft.RedHatOpenShift/openShiftClusters/$cluster_name?api-version=2025-07-25" \
--headers "Content-Type=application/json" \
--body "$(
jq -n \
--arg location "$location" \
--arg cluster_domain "$cluster_domain" \
--arg cluster_rg_id "$cluster_rg_id" \
--arg master_subnet_id "$master_subnet_id" \
--arg worker_subnet_id "$worker_subnet_id" \
--arg operator_identity_id "$operator_identity_id" \
'{
location: $location,
identity: {
type: "SystemAssigned"
},
properties: {
apiserverProfile: {
visibility: "Public"
},
clusterProfile: {
domain: $cluster_domain,
fipsValidatedModules: "Enabled",
resourceGroupId: $cluster_rg_id
},
consoleProfile: {},
networkProfile: {
podCidr: "10.128.0.0/14",
serviceCidr: "172.30.0.0/16",
loadBalancerProfile: {
managedOutboundIps: {
count: 1
}
},
preconfiguredNSG: "Disabled"
},
masterProfile: {
vmSize: "Standard_D8s_v3",
subnetId: $master_subnet_id,
encryptionAtHost: "Enabled"
},
workerProfiles: [
{
name: "worker",
vmSize: "Standard_D4s_v3",
diskSizeGB: 128,
subnetId: $worker_subnet_id,
count: 3,
encryptionAtHost: "Enabled"
}
],
platformWorkloadIdentityProfile: {
platformWorkloadIdentities: {
"aro-operator": {
resourceId: $operator_identity_id
}
}
},
ingressProfiles: [
{
name: "default",
visibility: "Public"
}
]
},
tags: {
key: "value"
}
}'
)"

# cleanup
az group delete --name "$rg_name" --yes --no-wait
```
```
Bad Request({"error":{"code":"CannotSetResourceIdentity","message":"Resource type 'Microsoft.RedHatOpenShift/OpenShiftClusters' does not support creation of 'SystemAssigned' resource identity. The supported types are 'UserAssigned'."}})
```

### Environment

_No response_

Contributor guide

Open the contributing guide

Research direction

Start with the linked redhatopenshift.json definition at lines 1000-1004, then compare its identity shape with common-types/resource-management/v6/managedidentity.json. Done means the 2025-07-25 OpenShiftClusters swagger advertises only the UserAssigned identity type supported by the API.

Written by the indexing model from the issue text.

Assessment

Tech stack
openapi
Domain
api
Issue type
Bug
Difficulty
1/5
Estimated time
Under an hour
Activity status
Quiet
Clarity
Clearly specified
Newbie friendliness
78/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.