Aad-pod-identity: resourceId validation is case-sensitive but regex doesn't match default Azure casing

[phealy]

Describe the bug
Per pull request #548, there is now validation performed on resourceIds, performed using a regex in utils.go. This regex is being applied using case sensitive matching, but the casing doesn't match the default output by Azure for managed identity resource IDs:

Example resource ID, copied from the portal:

/subscriptions/xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx/resourceGroups/ResourceGroupName/providers/Microsoft.ManagedIdentity/userAssignedIdentities/appgwContrIdentitydeea

The regular expression is matching for "resourcegroups" (lower case g) but the default export format uses "resourceGroups" (upper case g).

Steps To Reproduce

1. Install aad-pod-identity 1.6.0
2. Create a pod identity binding using a resource ID string coped from the portal
3. Receive the following error:

E0427 00:13:26.222815       1 mic.go:899] Ignoring azure identity default/agic-azid-ingress-azure, error: Invalid resource id: "/subscriptions/xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx/resourceGroups/ResourceGroupName/providers/Microsoft.ManagedIdentity/userAssignedIdentities/appgwContrIdentitydeea", must match /subscriptions/<subid>/resourcegroups/<resourcegroup>/providers/Microsoft.ManagedIdentity/userAssignedIdentities/<name>

Expected behavior
Matching is either case insensitive or matches what Azure uses by default.

AAD Pod Identity version
1.6.0, works in prior versions

Kubernetes version
verified on 1.15.10, but should be version independent

Additional context
None.

[phealy]

Actually, this may have been an alternate issue ... verifying.

[chewong]

Hi @phealy. The regex in https://github.com/aramase/aad-pod-identity/blob/89d7f1ca9829bfd01153a7f6af377b82c8642f79/pkg/utils/utils.go#L21 is case-insensitive with the (?i) flag. I verified with resourcegroups and resourceGroups in the resource id and they both work. Could you share the AzureIdentity and AzureIdentityBinding that you are using?

[phealy]

Yeah, sorry, this was an alternate issue and a miscopied error. Closing as user-error.

[evmimagina]

Hi @phealy and @chewong,

I'm affected by this issue as well,

Trying to deploy AGIC on AKS, it used to work with 1.5.5 but since deployment of versión 1.6 it fails with the same error.

I can tell that when using the "kubectl describe azureidentity **-ingress-azure" I get the correct Resource ID.

"/subscriptions/4c4aee1a-cfd4-4e7a-abe3-***/resourcegroups/RESOURCEGROUPNAME-NODES/providers/Microsoft.ManagedIdentity/userAssignedIdentities/MANAGEDIDENTITYNAME
"
wich matches the expected format
"
/subscriptions//resourcegroups//providers/Microsoft.ManagedIdentity/userAssignedIdentities/
"

were I can follow the progress? any workaround?

Many thanks and best regards,

[aramase]

@evmimagina With 1.6, there are some breaking changes for AzureIdentity and AzureIdentityBinding - https://github.com/Azure/aad-pod-identity#v160-breaking-change. Please review this and make the appropriate changes in the resource.

This change has been added to AGIC - https://github.com/Azure/application-gateway-kubernetes-ingress/pull/825

[evmimagina]

Hi @aramase ,

Thanks for the quick update! I didn't realised there was a new rc in place, I will try the 1.2.0-rc2.

Regards,