Azure operator sign-in and role repair
Azure operator sign-in and role repair
stado cloud login --provider azure --tenant <TENANT> --account <MICROSOFT-ACCOUNT> --role <OPERATOR-ROLE>
stado cloud roles repair --provider azure --operator-role <OPERATOR-ROLE> [--subscription <ID>] [--resource-group <GROUP>] [--storage-account <ACCOUNT>] [--remove-deny-name <TEXT>] [--json]
cloud login signs the operator in through Microsoft Account federation and
stores the refresh token in the vault item that plays --role; the item is
created and tagged when no item plays it yet. cloud roles repair reads that
session back by --operator-role, then gives Stado's control-plane principal
and the agent identity the roles they need on the subscription, resource group
and queue storage account, and reports the deny assignments in their way,
removing one only when its name contains --remove-deny-name and Azure does
not hold it itself. An assignment Azure lists without a name is reported
unreadable with its entry, and a selected one whose isSystemProtected
Azure did not state is reported protection_unreported; neither is deleted.
A role assignment Azure refuses is reported with its code and message
(null when Azure gave none) and Azure's whole answer. Both roles are
required: Stado assumes no vault role for
the operator session. Subscription, resource group and storage account fall
back to AZURE_SUBSCRIPTION_ID, the configured resource group and
WC_AZURE_STORAGE_ACCOUNT; a missing subscription is refused with
--subscription or AZURE_SUBSCRIPTION_ID is required. cloud roles repair
replaces the former cloud repair-rbac.
Source: this website