OSDOCS-13459#Add cross-subscription support for Azure File

[lpettyjo]

Version(s): 4.19+

Issue: https://issues.redhat.com/browse/OSDOCS-13459

Link to docs preview: https://92108--ocpdocs-pr.netlify.app/openshift-enterprise/latest/storage/container_storage_interface/persistent-storage-csi-azure-file.html#persistent-storage-csi-azure-file-cross-sub-overview_persistent-storage-csi-azure-file

QE review:

• QE has approved this change.

Additional information:

PTAL: @gcharot @jsafrane @duanwei33

[ocpdocs-previewbot]

🤖 Fri Apr 11 18:11:52 - Prow CI generated the docs preview:

https://92108--ocpdocs-pr.netlify.app/openshift-enterprise/latest/storage/container_storage_interface/persistent-storage-csi-azure-file.html

[openshift-ci]

@lpettyjo: all tests passed!

Full PR test history. Your PR dashboard.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

[mburke5678]

Do we need (service principal or managed identity) here, as it is in the prereqs?

Suggested change

	. Obtain the Azure identity (service principal or managed identity) permission to access the resource group in another subscription where you want to provision the Azure File share:
	. Record the Azure identity by running the following applicable commands. The Azure identity is needed in the next step:

[mburke5678]

Substeps?

Suggested change

	.. On the *Members* tab, choose an assignee by selecting the type of assignee: “User, group, or service principal” (Or “Managed identity”), click *Select members*, search for and then select the desired service principal or managed identity, and then click *Select* to confirm.
	.. On the *Members* tab:
	... Choose an assignee by selecting the type of assignee: “User, group, or service principal” (Or “Managed identity”).
	... Click *Select members*.
	... Search for and then select the desired service principal or managed identity.
	... Click *Select* to confirm.

[mburke5678]

Not sure what this means; maybe it is clearer in the UI

“User, group, or service principal” (Or “Managed identity”)

Maybe??

Suggested change

	.. On the *Members* tab, choose an assignee by selecting the type of assignee: “User, group, or service principal” (Or “Managed identity”), click *Select members*, search for and then select the desired service principal or managed identity, and then click *Select* to confirm.
	.. On the *Members* tab, choose an assignee by selecting the type of assignee: "User, group, or service principal" or "User, group, or Managed identity", click *Select members*, search for and then select the desired service principal or managed identity, and then click *Select* to confirm.

[mburke5678]

Also, should this be in mark up as UI elements?

Suggested change

	.. On the *Members* tab, choose an assignee by selecting the type of assignee: “User, group, or service principal” (Or “Managed identity”), click *Select members*, search for and then select the desired service principal or managed identity, and then click *Select* to confirm.
	.. On the *Members* tab, choose an assignee by selecting the type of assignee: *User, group, or service principal* (Or *Managed identity*), click *Select members*, search for and then select the desired service principal or managed identity, and then click *Select* to confirm.

[mburke5678]

Per ISG: Do not use just to mean only; use only instead. (Or nothing!).
I guessed on the phrasing at the end. It seemed to read only with the similar steps, rather than the storage account only, which I think is the case.

Suggested change

	If you just want to use a specific storage account to provision the Azure File share, you can also obtain the Azure identity (service principal or managed identity) permission to access the storage account only with the similar steps.
	If you want to use a specific storage account to provision the Azure File share, you can also obtain the Azure identity (service principal or managed identity) permission to access only the storage account by using similar steps.

[mburke5678]

Suggested change

	. Create an Azure File storage class using a similar configuration to the following:
	. Create an Azure File storage class by using a similar configuration to the following:

[mburke5678]

To be consistent?

Suggested change

	<4> Storage account name, if you want to specify your own
	<5> Name of the SKU type
	<4> The storage account name, if you want to specify your own
	<5> The name of the SKU type

[mburke5678]

Maybe a little clearer?

Suggested change

	. Create a persistent volume claim (PVC) specifying the Azure File storage class that you created in the previous step using a similar configuration to the following:
	. Create a persistent volume claim (PVC) that specifies the Azure File storage class you created in the previous step by using a similar configuration to the following:

[mburke5678]

Do we need the variables in the call-outs?

Suggested change

	<1> `<pvc-name>` is the name of the PVC.
	<2> `<sc-name-cross-sub>` is the name of the storage class that you created in the previous step.
	<1> The name of the PVC.
	<2> The name of the storage class that you created in the previous step.

[mburke5678]

??

Suggested change

	Cross-subscription support allows you to have an {product-title} cluster in one Azure subscription and mount your Azure file share in another Azure subscription using the Azure File Container Storage Interface (CSI) driver.
	Cross-subscription support allows you to have an {product-title} cluster in one Azure subscription and mount your Azure file share in another Azure subscription by using the Azure File Container Storage Interface (CSI) driver.

[mburke5678]

Suggested change

	[source,terminal]
	====
	$ sp_id=$(oc -n openshift-cluster-csi-drivers get secret azure-file-credentials -o jsonpath='{.data.azure_client_id}' | base64 --decode)
	$ az ad sp show --id ${sp_id} --query displayName --output tsv
	====
	[source,terminal]
	----
	$ sp_id=$(oc -n openshift-cluster-csi-drivers get secret azure-file-credentials -o jsonpath='{.data.azure_client_id}' | base64 --decode)
	$ az ad sp show --id ${sp_id} --query displayName --output tsv
	----

[mburke5678]

Suggested change

	[source,terminal]
	====
	$ mi_id=$(oc -n openshift-cluster-csi-drivers get secret azure-file-credentials -o jsonpath='{.data.azure_client_id}' | base64 --decode)
	$ az identity list --query "[?clientId=='${mi_id}'].{Name:name}" --output tsv
	====
	[source,terminal]
	----
	$ mi_id=$(oc -n openshift-cluster-csi-drivers get secret azure-file-credentials -o jsonpath='{.data.azure_client_id}' | base64 --decode)
	$ az identity list --query "[?clientId=='${mi_id}'].{Name:name}" --output tsv
	----

[mburke5678]

Suggested change

	.Example PV YAML file
	[source, terminal]
	.Example PV YAML file
	[source,yaml]

[mburke5678]

Not sure the space is needed, or does anything.

Suggested change

	[source, yaml]
	[source,yaml]

[mburke5678]

@lpettyjo A few suggestions. Otherwise LGTM