Skip to content

Commit f578eca

Browse files
committed
v0.8.2: rewrite custom-role Description to drop module-internal 'Step.4' jargon
The 'Azure Stack HCI Update Operator' custom role ships into the Azure RBAC plane: its Description shows up in the Azure portal 'Custom roles' blade, in 'az role definition list' / Get-AzRoleDefinition output, and in any RBAC audit / governance tooling. Referencing 'Step.4' there is confusing for anyone outside the AzLocal.UpdateManagement module - the step number is a module-private concept, not a user-facing one. Was: Can view and apply updates on Azure Local clusters, manage UpdateRing tags, and read the fleet-connectivity scopes (Arc machines, edge-device NICs, Azure Resource Bridges) required by Step.4. Now: Can read and apply Azure Local cluster updates, manage UpdateRing tags, and read the fleet-connectivity inventory (Arc-enabled machines, edge-device NICs, Azure Resource Bridges) needed to assess pre-update connectivity. Same RBAC grant; portable, audit-friendly wording. Updated in all 6 sites that ship/document the role definition: - Automation-Pipeline-Examples/azlocal-update-management-custom-role.json (the file 'az role definition create' consumes) - Automation-Pipeline-Examples/README.md (inline JSON block in section 4.1 + the Option 2 expanding here-string) - docs/rbac.md (first JSON block + Option 2 here-string + MG-scope variant) CHANGELOG v0.7.82 entry intentionally NOT touched - it describes what shipped at that time and is historical. No Pester pin on the Description string; manifest unaffected. JSON still parses, file still BOM-free (first byte 0x7B).
1 parent 1abc63d commit f578eca

3 files changed

Lines changed: 6 additions & 6 deletions

File tree

AzLocal.UpdateManagement/Automation-Pipeline-Examples/README.md

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -160,7 +160,7 @@ The recommended MG default is shown in the JSON below. Whichever path you pick,
160160
{
161161
"Name": "Azure Stack HCI Update Operator",
162162
"IsCustom": true,
163-
"Description": "Can view and apply updates on Azure Local clusters, manage UpdateRing tags, and read the fleet-connectivity scopes (Arc machines, edge-device NICs, Azure Resource Bridges) required by Step.4.",
163+
"Description": "Can read and apply Azure Local cluster updates, manage UpdateRing tags, and read the fleet-connectivity inventory (Arc-enabled machines, edge-device NICs, Azure Resource Bridges) needed to assess pre-update connectivity.",
164164
"Actions": [
165165
"Microsoft.AzureStackHCI/clusters/read",
166166
"Microsoft.AzureStackHCI/clusters/updateSummaries/read",
@@ -228,7 +228,7 @@ az role definition create --role-definition ./azlocal-update-management-custom-r
228228
{
229229
"Name": "Azure Stack HCI Update Operator",
230230
"IsCustom": true,
231-
"Description": "Can view and apply updates on Azure Local clusters, manage UpdateRing tags, and read the fleet-connectivity scopes (Arc machines, edge-device NICs, Azure Resource Bridges) required by Step.4.",
231+
"Description": "Can read and apply Azure Local cluster updates, manage UpdateRing tags, and read the fleet-connectivity inventory (Arc-enabled machines, edge-device NICs, Azure Resource Bridges) needed to assess pre-update connectivity.",
232232
"Actions": [
233233
"Microsoft.AzureStackHCI/clusters/read",
234234
"Microsoft.AzureStackHCI/clusters/updateSummaries/read",

AzLocal.UpdateManagement/Automation-Pipeline-Examples/azlocal-update-management-custom-role.json

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
{
22
"Name": "Azure Stack HCI Update Operator",
33
"IsCustom": true,
4-
"Description": "Can view and apply updates on Azure Local clusters, manage UpdateRing tags, and read the fleet-connectivity scopes (Arc machines, edge-device NICs, Azure Resource Bridges) required by Step.4.",
4+
"Description": "Can read and apply Azure Local cluster updates, manage UpdateRing tags, and read the fleet-connectivity inventory (Arc-enabled machines, edge-device NICs, Azure Resource Bridges) needed to assess pre-update connectivity.",
55
"Actions": [
66
"Microsoft.AzureStackHCI/clusters/read",
77
"Microsoft.AzureStackHCI/clusters/updateSummaries/read",

AzLocal.UpdateManagement/docs/rbac.md

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -57,7 +57,7 @@ If you need a least-privilege custom role specifically for update operations:
5757
{
5858
"Name": "Azure Stack HCI Update Operator",
5959
"IsCustom": true,
60-
"Description": "Can view and apply updates on Azure Local clusters, manage UpdateRing tags, and read the fleet-connectivity scopes (Arc machines, edge-device NICs, Azure Resource Bridges) required by Step.4.",
60+
"Description": "Can read and apply Azure Local cluster updates, manage UpdateRing tags, and read the fleet-connectivity inventory (Arc-enabled machines, edge-device NICs, Azure Resource Bridges) needed to assess pre-update connectivity.",
6161
"Actions": [
6262
"Microsoft.AzureStackHCI/clusters/read",
6363
"Microsoft.AzureStackHCI/clusters/updateSummaries/read",
@@ -104,7 +104,7 @@ az role definition create --role-definition ./azlocal-update-management-custom-r
104104
{
105105
"Name": "Azure Stack HCI Update Operator",
106106
"IsCustom": true,
107-
"Description": "Can view and apply updates on Azure Local clusters, manage UpdateRing tags, and read the fleet-connectivity scopes (Arc machines, edge-device NICs, Azure Resource Bridges) required by Step.4.",
107+
"Description": "Can read and apply Azure Local cluster updates, manage UpdateRing tags, and read the fleet-connectivity inventory (Arc-enabled machines, edge-device NICs, Azure Resource Bridges) needed to assess pre-update connectivity.",
108108
"Actions": [
109109
"Microsoft.AzureStackHCI/clusters/read",
110110
"Microsoft.AzureStackHCI/clusters/updateSummaries/read",
@@ -157,7 +157,7 @@ Replace the per-subscription entry shown above with one (or more) management-gro
157157
{
158158
"Name": "Azure Stack HCI Update Operator",
159159
"IsCustom": true,
160-
"Description": "Can view and apply updates on Azure Local clusters, manage UpdateRing tags, and read the fleet-connectivity scopes (Arc machines, edge-device NICs, Azure Resource Bridges) required by Step.4.",
160+
"Description": "Can read and apply Azure Local cluster updates, manage UpdateRing tags, and read the fleet-connectivity inventory (Arc-enabled machines, edge-device NICs, Azure Resource Bridges) needed to assess pre-update connectivity.",
161161
"Actions": [
162162
"Microsoft.AzureStackHCI/clusters/read",
163163
"Microsoft.AzureStackHCI/clusters/updateSummaries/read",

0 commit comments

Comments
 (0)