Skip to content

Commit c6f1319

Browse files
committed
Add privateEndpointConnections/delete permission for Azure PLS cleanup
The cloud-provider-azure CCM calls safeDeletePLS() when removing a Private Link Service (e.g. when a LoadBalancer Service with the azure-pls-create annotation is deleted). This function iterates over all PrivateEndpointConnections on the PLS and deletes each one before deleting the PLS itself, because Azure does not allow deleting a PLS that has active Private Endpoint connections from consumers. Without this permission, PLS cleanup fails when an external consumer has connected to the service via a Private Endpoint.
1 parent 92657ec commit c6f1319

1 file changed

Lines changed: 1 addition & 0 deletions

File tree

manifests/0000_26_cloud-controller-manager-operator_14_credentialsrequest-azure.yaml

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -31,6 +31,7 @@ spec:
3131
- Microsoft.Network/networkSecurityGroups/write
3232
- Microsoft.Network/networkSecurityGroups/join/action
3333
- Microsoft.Network/privatelinkservices/delete
34+
- Microsoft.Network/privatelinkservices/privateEndpointConnections/delete
3435
- Microsoft.Network/privatelinkservices/read
3536
- Microsoft.Network/privatelinkservices/write
3637
- Microsoft.Network/publicIPAddresses/delete

0 commit comments

Comments
 (0)