Azure / Azure/azure-rest-api-specs
[BUG]Microsoft.RedHatOpenShift 2025-07-25 should model `identity` as UserAssigned only for `openShiftClusters`
- Dominant language
- TypeSpec
- Stars
- 3.1k
- Forks
- 5.9k
- Avg merge
- 3d 2h
- Merged PRs (30d)
- 424
Description
### API Spec link
https://github.com/Azure/azure-rest-api-specs/blob/5a45c68db967ced0736a2f91a74774a65771dadc/specification/redhatopenshift/resource-manager/Microsoft.RedHatOpenShift/OpenShiftClusters/stable/2025-07-25/redhatopenshift.json#L1000-L1004
### API Spec version
2025-07-25
### Describe the bug
The `2025-07-25` stable swagger for `Microsoft.RedHatOpenShift/openShiftClusters` appears to expose a broader managed identity shape than the API actually accepts, API only supports `UserAssigned`, otherwise will return 400 Bad Request error
https://github.com/Azure/azure-rest-api-specs/blob/5a45c68db967ced0736a2f91a74774a65771dadc/specification/common-types/resource-management/v6/managedidentity.json#L41-L54
### Expected behavior
the swagger should only include UserAssigned as the API actually accepts
### Actual behavior
the swagger include below identity types:
"None",
"SystemAssigned",
"UserAssigned",
"SystemAssigned,UserAssigned"
### Reproduction Steps
```
repro_id="aro43540$(date +%H%M%S)"
rg_name="$repro_id-rg"
cluster_name="$repro_id"
location="australiaeast"
sub_id="$(az account show --query id -o tsv | tr -d '\r\n')"
az group create --name "$rg_name" --location "$location"
az identity create \
--resource-group "$rg_name" \
--name "$repro_id-operator" \
--location "$location"
az network vnet create \
--resource-group "$rg_name" \
--name "$repro_id-vnet" \
--location "$location" \
--address-prefixes 10.0.0.0/22 \
--subnet-name master \
--subnet-prefixes 10.0.0.0/23
az network vnet subnet create \
--resource-group "$rg_name" \
--vnet-name "$repro_id-vnet" \
--name worker \
--address-prefixes 10.0.2.0/23
operator_identity_id="$(az identity show --resource-group "$rg_name" --name "$repro_id-operator" --query id -o tsv | tr -d '\r\n')"
master_subnet_id="$(az network vnet subnet show --resource-group "$rg_name" --vnet-name "$repro_id-vnet" --name master --query id -o tsv | tr -d '\r\n')"
worker_subnet_id="$(az network vnet subnet show --resource-group "$rg_name" --vnet-name "$repro_id-vnet" --name worker --query id -o tsv | tr -d '\r\n')"
cluster_domain="$cluster_name.aro-example.com"
cluster_rg_id="/subscriptions/$sub_id/resourceGroups/aro-$cluster_domain-$location"
az rest \
--method put \
--url "/subscriptions/$sub_id/resourceGroups/$rg_name/providers/Microsoft.RedHatOpenShift/openShiftClusters/$cluster_name?api-version=2025-07-25" \
--headers "Content-Type=application/json" \
--body "$(
jq -n \
--arg location "$location" \
--arg cluster_domain "$cluster_domain" \
--arg cluster_rg_id "$cluster_rg_id" \
--arg master_subnet_id "$master_subnet_id" \
--arg worker_subnet_id "$worker_subnet_id" \
--arg operator_identity_id "$operator_identity_id" \
'{
location: $location,
identity: {
type: "SystemAssigned"
},
properties: {
apiserverProfile: {
visibility: "Public"
},
clusterProfile: {
domain: $cluster_domain,
fipsValidatedModules: "Enabled",
resourceGroupId: $cluster_rg_id
},
consoleProfile: {},
networkProfile: {
podCidr: "10.128.0.0/14",
serviceCidr: "172.30.0.0/16",
loadBalancerProfile: {
managedOutboundIps: {
count: 1
}
},
preconfiguredNSG: "Disabled"
},
masterProfile: {
vmSize: "Standard_D8s_v3",
subnetId: $master_subnet_id,
encryptionAtHost: "Enabled"
},
workerProfiles: [
{
name: "worker",
vmSize: "Standard_D4s_v3",
diskSizeGB: 128,
subnetId: $worker_subnet_id,
count: 3,
encryptionAtHost: "Enabled"
}
],
platformWorkloadIdentityProfile: {
platformWorkloadIdentities: {
"aro-operator": {
resourceId: $operator_identity_id
}
}
},
ingressProfiles: [
{
name: "default",
visibility: "Public"
}
]
},
tags: {
key: "value"
}
}'
)"
# cleanup
az group delete --name "$rg_name" --yes --no-wait
```
```
Bad Request({"error":{"code":"CannotSetResourceIdentity","message":"Resource type 'Microsoft.RedHatOpenShift/OpenShiftClusters' does not support creation of 'SystemAssigned' resource identity. The supported types are 'UserAssigned'."}})
```
### Environment
_No response_
Contributor guide
Research direction
Start with the linked redhatopenshift.json definition at lines 1000-1004, then compare its identity shape with common-types/resource-management/v6/managedidentity.json. Done means the 2025-07-25 OpenShiftClusters swagger advertises only the UserAssigned identity type supported by the API.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- openapi
- Domain
- api
- Issue type
- Bug
- Difficulty
- 1/5
- Estimated time
- Under an hour
- Activity status
- Quiet
- Clarity
- Clearly specified
- Newbie friendliness
- 78/100