- fence_azure_arm: use azure-identity instead of msrestazure, which has

been deprecated Resolves: RHEL-76493
2025-01-31 10:28:39 +01:00 · 2025-01-31 10:28:39 +01:00 · 9b03ac428d
commit 9b03ac428d
parent 2d20c4da95
3 changed files with 563 additions and 78 deletions
--- a/RHEL-76492-fence_azure_arm-use-azure-identity.patch
+++ b/RHEL-76492-fence_azure_arm-use-azure-identity.patch
@ -0,0 +1,472 @@
+--- a/lib/azure_fence.py.py	2025-01-30 14:59:48.211366580 +0100
+++ b/lib/azure_fence.py.py	2025-01-30 12:06:10.847889534 +0100
+@@ -1,9 +1,6 @@
+ import logging, re, time
+ from fencing import fail_usage
+ 
+-import sys
+-sys.path.insert(0, '/usr/lib/fence-agents/support/azure')
+-
+ FENCE_SUBNET_NAME = "fence-subnet"
+ FENCE_INBOUND_RULE_NAME = "FENCE_DENY_ALL_INBOUND"
+ FENCE_INBOUND_RULE_DIRECTION = "Inbound"
+@@ -17,6 +14,9 @@
+ IP_TYPE_DYNAMIC = "Dynamic"
+ MAX_RETRY = 10
+ RETRY_WAIT = 5
+NETWORK_MGMT_CLIENT_API_VERSION = "2021-05-01"
+AZURE_RHEL8_COMPUTE_VERSION = "27.2.0"
+AZURE_COMPUTE_VERSION_5 = "5.0.0"
+ 
+ class AzureSubResource:
+     Type = None
+@@ -52,7 +52,7 @@
+     return None
+ 
+ def get_azure_resource(id):
+-    match = re.match('(/subscriptions/([^/]*)/resourceGroups/([^/]*))(/providers/([^/]*/[^/]*)/([^/]*))?((/([^/]*)/([^/]*))*)', id)
+    match = re.match(r'(/subscriptions/([^/]*)/resourceGroups/([^/]*))(/providers/([^/]*/[^/]*)/([^/]*))?((/([^/]*)/([^/]*))*)', id)
+     if not match:
+         fail_usage("{get_azure_resource} cannot parse resource id %s" % id)
+ 
+@@ -89,6 +89,59 @@
+ 
+     return resource
+ 
+def azure_dep_versions(v):
+    return tuple(map(int, (v.split("."))))
+
+# Do azure API call to list all virtual machines in a resource group
+def get_vm_list(compute_client,rgName):
+    return compute_client.virtual_machines.list(rgName)
+
+# Do azue API call to shutdown a virtual machine
+def do_vm_power_off(compute_client,rgName,vmName, skipShutdown):
+    try:
+        # Version is not available in azure-mgmt-compute version 14.0.0 until 27.2.0
+        from azure.mgmt.compute import __version__
+    except ImportError:
+        __version__ = "0.0.0"
+
+    # use different implementation call based on used version
+    if (azure_dep_versions(__version__) == azure_dep_versions(AZURE_COMPUTE_VERSION_5)):
+        logging.debug("{do_vm_power_off} azure.mgtm.compute version is to old to use 'begin_power_off' use 'power_off' function")
+        compute_client.virtual_machines.power_off(rgName, vmName, skip_shutdown=skipShutdown)
+        return
+
+    compute_client.virtual_machines.begin_power_off(rgName, vmName, skip_shutdown=skipShutdown)
+
+# Do azure API call to start a virtual machine
+def do_vm_start(compute_client,rgName,vmName):
+    try:
+        # Version is not available in azure-mgmt-compute version 14.0.0 until 27.2.0
+        from azure.mgmt.compute import __version__
+    except ImportError:
+        __version__ = "0.0.0"
+
+    # use different implementation call based on used version
+    if (azure_dep_versions(__version__) == azure_dep_versions(AZURE_COMPUTE_VERSION_5)):
+        logging.debug("{do_vm_start} azure.mgtm.compute version is to old to use 'begin_start' use 'start' function")
+        compute_client.virtual_machines.start(rgName, vmName)
+        return
+
+    compute_client.virtual_machines.begin_start(rgName, vmName)
+
+def get_vm_resource(compute_client, rgName, vmName):
+    try:
+        # Version is not available in azure-mgmt-compute version 14.0.0 until 27.2.0
+        from azure.mgmt.compute import __version__
+    except ImportError:
+        __version__ = "0.0.0"
+
+    # use different implementation call based on used version
+    if (azure_dep_versions(__version__) <= azure_dep_versions(AZURE_RHEL8_COMPUTE_VERSION)):
+        return compute_client.virtual_machines.get(rgName, vmName, "instanceView")
+
+    return compute_client.virtual_machines.get(resource_group_name=rgName, vm_name=vmName,expand="instanceView")
+
+
+ def get_fence_subnet_for_config(ipConfig, network_client):
+     subnetResource = get_azure_resource(ipConfig.subnet.id)
+     logging.debug("{get_fence_subnet_for_config} testing virtual network %s in resource group %s for a fence subnet" %(subnetResource.ResourceName, subnetResource.ResourceGroupName))
+@@ -155,7 +208,7 @@
+     result = FENCE_STATE_ON
+ 
+     try:
+-        vm = compute_client.virtual_machines.get(rgName, vmName, "instanceView")
+        vm = get_vm_resource(compute_client, rgName, vmName)
+ 
+         allNICOK = True
+         for nicRef in vm.network_profile.network_interfaces:
+@@ -182,7 +235,7 @@
+     import msrestazure.azure_exceptions
+     logging.info("{set_network_state} Setting state %s for  %s in resource group %s" % (operation, vmName, rgName))
+ 
+-    vm = compute_client.virtual_machines.get(rgName, vmName, "instanceView")
+    vm = get_vm_resource(compute_client,rgName, vmName)
+ 
+     operations = []
+     for nicRef in vm.network_profile.network_interfaces:
+@@ -271,10 +324,72 @@
+ 
+     return config
+ 
+# Function to fetch endpoints from metadata endpoint for azure_stack
+def get_cloud_from_arm_metadata_endpoint(arm_endpoint):
+    try:
+        import requests
+        session = requests.Session()
+        metadata_endpoint = arm_endpoint + "/metadata/endpoints?api-version=2015-01-01"
+        response = session.get(metadata_endpoint)
+        if response.status_code == 200:
+            metadata = response.json()
+            return {
+                "resource_manager": arm_endpoint,
+                "credential_scopes": [metadata.get("graphEndpoint") + "/.default"],
+                "authority_hosts":  metadata['authentication'].get('loginEndpoint').replace("https://","")
+            }
+        else:
+            fail_usage("Failed to get cloud from metadata endpoint: %s - %s" % arm_endpoint, e)
+    except Exception as e:
+        fail_usage("Failed to get cloud from metadata endpoint: %s - %s" % arm_endpoint, e)
+
+def get_azure_arm_endpoints(cloudName, authority):
+    cloudEnvironment = {
+        "authority_hosts": authority
+    }
+
+    if cloudName == "AZURE_CHINA_CLOUD":
+        cloudEnvironment["resource_manager"] = "https://management.chinacloudapi.cn/"
+        cloudEnvironment["credential_scopes"] = ["https://management.chinacloudapi.cn/.default"]
+        return cloudEnvironment
+
+    if cloudName == "AZURE_US_GOV_CLOUD":
+        cloudEnvironment["resource_manager"] = "https://management.usgovcloudapi.net/"
+        cloudEnvironment["credential_scopes"] = ["https://management.core.usgovcloudapi.net/.default"]
+        return cloudEnvironment
+
+    if cloudName == "AZURE_PUBLIC_CLOUD":
+        cloudEnvironment["resource_manager"] = "https://management.azure.com/"
+        cloudEnvironment["credential_scopes"] = ["https://management.azure.com/.default"]
+        return cloudEnvironment
+
+
+ def get_azure_cloud_environment(config):
+-    cloud_environment = None
+-    if config.Cloud:
+    if (config.Cloud is None):
+        config.Cloud = "public"
+
+    try:
+        from azure.identity import AzureAuthorityHosts
+
+        azureCloudName = "AZURE_PUBLIC_CLOUD"
+        authorityHosts = AzureAuthorityHosts.AZURE_PUBLIC_CLOUD
+         if (config.Cloud.lower() == "china"):
+            azureCloudName = "AZURE_CHINA_CLOUD"
+            authorityHosts = AzureAuthorityHosts.AZURE_CHINA
+        elif (config.Cloud.lower() == "usgov"):
+            azureCloudName = "AZURE_US_GOV_CLOUD"
+            authorityHosts = AzureAuthorityHosts.AZURE_GOVERNMENT
+        elif (config.Cloud.lower() == "stack"):
+            # use custom function to call the azuer stack metadata endpoint to get required configuration.
+            return get_cloud_from_arm_metadata_endpoint(config.MetadataEndpoint)
+
+        return get_azure_arm_endpoints(azureCloudName, authorityHosts)
+
+    except ImportError:
+        if (config.Cloud.lower() == "public"):
+            from msrestazure.azure_cloud import AZURE_PUBLIC_CLOUD
+            cloud_environment = AZURE_PUBLIC_CLOUD
+        elif (config.Cloud.lower() == "china"):
+             from msrestazure.azure_cloud import AZURE_CHINA_CLOUD
+             cloud_environment = AZURE_CHINA_CLOUD
+         elif (config.Cloud.lower() == "germany"):
+@@ -287,61 +402,44 @@
+             from msrestazure.azure_cloud import get_cloud_from_metadata_endpoint
+             cloud_environment = get_cloud_from_metadata_endpoint(config.MetadataEndpoint)
+ 
+-    return cloud_environment
+        authority_hosts = cloud_environment.endpoints.active_directory.replace("http://","")
+        return {
+            "resource_manager": cloud_environment.endpoints.resource_manager,
+            "credential_scopes": [cloud_environment.endpoints.active_directory_resource_id + "/.default"],
+            "authority_hosts": authority_hosts,
+            "cloud_environment": cloud_environment,
+        }
+ 
+ def get_azure_credentials(config):
+     credentials = None
+     cloud_environment = get_azure_cloud_environment(config)
+-    if config.UseMSI and cloud_environment:
+-        try:
+-            from azure.identity import ManagedIdentityCredential
+-            credentials = ManagedIdentityCredential(cloud_environment=cloud_environment)
+-        except ImportError:
+-            from msrestazure.azure_active_directory import MSIAuthentication
+-            credentials = MSIAuthentication(cloud_environment=cloud_environment)
+-    elif config.UseMSI:
+    if config.UseMSI:
+         try:
+             from azure.identity import ManagedIdentityCredential
+-            credentials = ManagedIdentityCredential()
+            credentials = ManagedIdentityCredential(authority=cloud_environment["authority_hosts"])
+         except ImportError:
+             from msrestazure.azure_active_directory import MSIAuthentication
+-            credentials = MSIAuthentication()
+-    elif cloud_environment:
+-        try:
+-            # try to use new libraries ClientSecretCredential (azure.identity, based on azure.core)
+-            from azure.identity import ClientSecretCredential
+-            credentials = ClientSecretCredential(
+-                client_id = config.ApplicationId,
+-                client_secret = config.ApplicationKey,
+-                tenant_id = config.Tenantid,
+-                cloud_environment=cloud_environment
+-            )
+-        except ImportError:
+-             # use old libraries ServicePrincipalCredentials (azure.common) if new one is not available
+-            from azure.common.credentials import ServicePrincipalCredentials
+-            credentials = ServicePrincipalCredentials(
+-                client_id = config.ApplicationId,
+-                secret = config.ApplicationKey,
+-                tenant = config.Tenantid,
+-                cloud_environment=cloud_environment
+-            )
+-    else:
+-        try:
+-            # try to use new libraries ClientSecretCredential (azure.identity, based on azure.core)
+-            from azure.identity import ClientSecretCredential
+-            credentials = ClientSecretCredential(
+-                client_id = config.ApplicationId,
+-                client_secret = config.ApplicationKey,
+-                tenant_id = config.Tenantid
+-            )
+-        except ImportError:
+-             # use old libraries ServicePrincipalCredentials (azure.common) if new one is not available
+-            from azure.common.credentials import ServicePrincipalCredentials
+-            credentials = ServicePrincipalCredentials(
+-                client_id = config.ApplicationId,
+-                secret = config.ApplicationKey,
+-                tenant = config.Tenantid
+-            )
+            credentials = MSIAuthentication(cloud_environment=cloud_environment["cloud_environment"])
+        return credentials
+
+    try:
+        # try to use new libraries ClientSecretCredential (azure.identity, based on azure.core)
+        from azure.identity import ClientSecretCredential
+        credentials = ClientSecretCredential(
+            client_id = config.ApplicationId,
+            client_secret = config.ApplicationKey,
+            tenant_id = config.Tenantid,
+            authority=cloud_environment["authority_hosts"]
+        )
+    except ImportError:
+         # use old libraries ServicePrincipalCredentials (azure.common) if new one is not available
+        from azure.common.credentials import ServicePrincipalCredentials
+        credentials = ServicePrincipalCredentials(
+            client_id = config.ApplicationId,
+            secret = config.ApplicationKey,
+            tenant = config.Tenantid,
+            cloud_environment=cloud_environment["cloud_environment"]
+        )
+ 
+     return credentials
+ 
+@@ -351,36 +449,40 @@
+     cloud_environment = get_azure_cloud_environment(config)
+     credentials = get_azure_credentials(config)
+ 
+-    if cloud_environment:
+-        if (config.Cloud.lower() == "stack") and not config.MetadataEndpoint:
+-                fail_usage("metadata-endpoint not specified")
+    # Try to read the default used api version from the installed package.
+    try:
+        compute_api_version = ComputeManagementClient.LATEST_PROFILE.get_profile_dict()["azure.mgmt.compute.ComputeManagementClient"]["virtual_machines"]
+    except Exception as e:
+        compute_api_version = ComputeManagementClient.DEFAULT_API_VERSION
+        logging.debug("{get_azure_compute_client} Failed to get the latest profile: %s using the default api version %s" % (e, compute_api_version))
+ 
+-        try:
+-            from azure.profiles import KnownProfiles
+-            if (config.Cloud.lower() == "stack"):
+-                client_profile = KnownProfiles.v2020_09_01_hybrid
+-                credential_scope = cloud_environment.endpoints.active_directory_resource_id + "/.default"
+-            else:
+-                client_profile = KnownProfiles.default
+-                credential_scope = cloud_environment.endpoints.resource_manager + "/.default"
+-            compute_client = ComputeManagementClient(
+-                credentials,
+-                config.SubscriptionId,
+-                base_url=cloud_environment.endpoints.resource_manager,
+-                profile=client_profile,
+-                credential_scopes=[credential_scope],
+-            )
+-        except TypeError:
+-            compute_client = ComputeManagementClient(
+-                credentials,
+-                config.SubscriptionId,
+-                base_url=cloud_environment.endpoints.resource_manager
+-            )
+-    else:
+    logging.debug("{get_azure_compute_client} use virtual_machine api version: %s" %(compute_api_version))
+
+    if (config.Cloud.lower() == "stack") and not config.MetadataEndpoint:
+            fail_usage("metadata-endpoint not specified")
+
+    try:
+        from azure.profiles import KnownProfiles
+        if (config.Cloud.lower() == "stack"):
+            client_profile = KnownProfiles.v2020_09_01_hybrid
+        else:
+            client_profile = KnownProfiles.default
+         compute_client = ComputeManagementClient(
+             credentials,
+-            config.SubscriptionId
+            config.SubscriptionId,
+            base_url=cloud_environment["resource_manager"],
+            profile=client_profile,
+            credential_scopes=cloud_environment["credential_scopes"],
+            api_version=compute_api_version
+         )
+    except TypeError:
+        compute_client = ComputeManagementClient(
+            credentials,
+            config.SubscriptionId,
+            base_url=cloud_environment["resource_manager"],
+            api_version=compute_api_version
+        )
+
+     return compute_client
+ 
+ def get_azure_network_client(config):
+@@ -389,34 +491,31 @@
+     cloud_environment = get_azure_cloud_environment(config)
+     credentials = get_azure_credentials(config)
+ 
+-    if cloud_environment:
+-        if (config.Cloud.lower() == "stack") and not config.MetadataEndpoint:
+-                fail_usage("metadata-endpoint not specified")
+    if (config.Cloud.lower() == "stack") and not config.MetadataEndpoint:
+        fail_usage("metadata-endpoint not specified")
+ 
+-        try:
+-            from azure.profiles import KnownProfiles
+-            if (config.Cloud.lower() == "stack"):
+-                client_profile = KnownProfiles.v2020_09_01_hybrid
+-                credential_scope = cloud_environment.endpoints.active_directory_resource_id + "/.default"
+-            else:
+-                client_profile = KnownProfiles.default
+-                credential_scope = cloud_environment.endpoints.resource_manager + "/.default"
+-            network_client = NetworkManagementClient(
+-                credentials,
+-                config.SubscriptionId,
+-                base_url=cloud_environment.endpoints.resource_manager,
+-                profile=client_profile,
+-                credential_scopes=[credential_scope],
+-            )
+-        except TypeError:
+-            network_client = NetworkManagementClient(
+-                credentials,
+-                config.SubscriptionId,
+-                base_url=cloud_environment.endpoints.resource_manager
+-            )
+
+    from azure.profiles import KnownProfiles
+
+    if (config.Cloud.lower() == "stack"):
+        client_profile = KnownProfiles.v2020_09_01_hybrid
+     else:
+        client_profile = KnownProfiles.default
+
+    try:
+        network_client = NetworkManagementClient(
+            credentials,
+            config.SubscriptionId,
+            base_url=cloud_environment["resource_manager"],
+            profile=client_profile,
+            credential_scopes=cloud_environment["credential_scopes"],
+            api_version=NETWORK_MGMT_CLIENT_API_VERSION
+        )
+    except TypeError:
+         network_client = NetworkManagementClient(
+             credentials,
+-            config.SubscriptionId
+            config.SubscriptionId,
+            base_url=cloud_environment["resource_manager"],
+            api_version=NETWORK_MGMT_CLIENT_API_VERSION
+         )
+     return network_client
+--- a/agents/azure_arm/fence_azure_arm.py	2025-01-30 14:59:48.218366743 +0100
+++ b/agents/azure_arm/fence_azure_arm.py	2025-01-28 13:12:00.758567141 +0100
+@@ -2,6 +2,7 @@
+ 
+ import sys, re
+ sys.path.insert(0, '/usr/lib/fence-agents/support/common')
+sys.path.insert(1, '/usr/lib/fence-agents/support/azure')
+ try:
+     import pexpect
+ except:
+@@ -20,7 +21,7 @@
+     if clients:
+         compute_client = clients[0]
+         rgName = options["--resourceGroup"]
+-        vms = compute_client.virtual_machines.list(rgName)
+        vms = azure_fence.get_vm_list(compute_client,rgName)
+         try:
+             for vm in vms:
+                 result[vm.name] = ("", None)
+@@ -36,7 +37,7 @@
+         rgName = options["--resourceGroup"]
+ 
+         try:
+-            vms = compute_client.virtual_machines.list(rgName)
+            vms = azure_fence.get_vm_list(compute_client,rgName)
+         except Exception as e:
+             fail_usage("Failed: %s" % e)
+ 
+@@ -77,7 +78,7 @@
+ 
+         powerState = "unknown"
+         try:
+-            vmStatus = compute_client.virtual_machines.get(rgName, vmName, "instanceView")
+            vmStatus = azure_fence.get_vm_resource(compute_client, rgName, vmName)
+         except Exception as e:
+             fail_usage("Failed: %s" % e)
+ 
+@@ -120,23 +121,10 @@
+ 
+         if (options["--action"]=="off"):
+             logging.info("Poweroff " + vmName + " in resource group " + rgName)
+-            try:
+-                # try new API version first
+-                compute_client.virtual_machines.begin_power_off(rgName, vmName, skip_shutdown=True)
+-            except AttributeError:
+-                # use older API verson if it fails
+-                logging.debug("Poweroff " + vmName + " did not work via 'virtual_machines.begin_power_off. Trying virtual_machines.power_off'.")
+-                compute_client.virtual_machines.power_off(rgName, vmName, skip_shutdown=True)
+            azure_fence.do_vm_power_off(compute_client, rgName, vmName, True)
+         elif (options["--action"]=="on"):
+             logging.info("Starting " + vmName + " in resource group " + rgName)
+-            try:
+-                # try new API version first
+-                compute_client.virtual_machines.begin_start(rgName, vmName)
+-            except AttributeError:
+-                # use older API verson if it fails
+-                logging.debug("Starting " + vmName + " did not work via 'virtual_machines.begin_start. Trying virtual_machines.start'.")
+-                compute_client.virtual_machines.start(rgName, vmName)
+-
+            azure_fence.do_vm_start(compute_client, rgName, vmName)
+ 
+ def define_new_opts():
+     all_opt["resourceGroup"] = {
+@@ -256,7 +244,7 @@
+     except ImportError:
+         fail_usage("Azure Resource Manager Python SDK not found or not accessible")
+     except Exception as e:
+-        fail_usage("Failed: %s" % re.sub("^, ", "", str(e)))
+        fail_usage("Failed: %s" % re.sub(r"^, ", r"", str(e)))
+ 
+     if "--network-fencing" in options:
+         # use  off-action to quickly return off once network is fenced instead of
--- a/fence-agents.spec
+++ b/fence-agents.spec
@ -57,7 +57,7 @@
 Name: fence-agents
 Summary: Set of unified programs capable of host isolation ("fencing")
 Version: 4.10.0
-Release: 83%{?alphatag:.%{alphatag}}%{?dist}
+Release: 84%{?alphatag:.%{alphatag}}%{?dist}
 License: GPLv2+ and LGPLv2+
 URL: https://github.com/ClusterLabs/fence-agents
 Source0: https://fedorahosted.org/releases/f/e/fence-agents/%{name}-%{version}.tar.gz
@ -94,58 +94,57 @@ Source1007: boto3-1.17.102-py2.py3-none-any.whl
 Source1008: botocore-1.20.102-py2.py3-none-any.whl
 Source1009: python_dateutil-2.8.1-py2.py3-none-any.whl
 Source1010: s3transfer-0.4.2-py2.py3-none-any.whl
-Source1011: urllib3-1.26.18.tar.gz
+Source1011: %{urllib3}-%{urllib3_version}.tar.gz
 # azure
-Source1012: adal-1.2.7-py2.py3-none-any.whl
-Source1013: azure_common-1.1.27-py2.py3-none-any.whl
-Source1014: azure_core-1.15.0-py2.py3-none-any.whl
-Source1015: azure_mgmt_compute-21.0.0-py2.py3-none-any.whl
-Source1016: azure_mgmt_core-1.2.2-py2.py3-none-any.whl
-Source1017: azure_mgmt_network-19.0.0-py2.py3-none-any.whl
-Source1018: azure-identity-1.10.0.zip
+Source1012: adal-1.2.7.tar.gz
+Source1013: azure-common-1.1.28.zip
+Source1014: azure_core-1.32.0.tar.gz
+Source1015: azure_mgmt_compute-34.0.0.tar.gz
+Source1016: azure_mgmt_core-1.5.0.tar.gz
+Source1017: azure_mgmt_network-28.1.0.tar.gz
+Source1018: azure_identity-1.19.0.tar.gz
 Source1019: chardet-4.0.0-py2.py3-none-any.whl
-Source1020: idna-2.10-py2.py3-none-any.whl
-Source1021: isodate-0.6.0-py2.py3-none-any.whl
-Source1022: msrest-0.6.21-py2.py3-none-any.whl
-Source1023: msrestazure-0.6.4-py2.py3-none-any.whl
-Source1024: %{oauthlib}-%{oauthlib_version}.tar.gz
-Source1025: PyJWT-2.1.0-py3-none-any.whl
-Source1026: requests-2.25.1-py2.py3-none-any.whl
-Source1027: requests_oauthlib-1.3.0-py2.py3-none-any.whl
-Source1028: msal-1.18.0.tar.gz
-Source1029: msal-extensions-1.0.0.tar.gz
-Source1030: portalocker-2.5.1.tar.gz
-Source1031: cryptography-3.3.2-cp36-abi3-manylinux2010_x86_64.whl
+Source1020: isodate-0.6.1.tar.gz
+Source1021: msrest-0.7.1.zip
+Source1022: msrestazure-0.6.4.post1.tar.gz
+Source1023: %{oauthlib}-%{oauthlib_version}.tar.gz
+Source1024: PyJWT-2.1.0-py3-none-any.whl
+Source1025: requests_oauthlib-1.3.0-py2.py3-none-any.whl
+Source1026: msal-1.31.1.tar.gz
+Source1027: msal_extensions-1.2.0.tar.gz
+Source1028: portalocker-2.5.1.tar.gz
+Source1029: cryptography-3.3.2-cp36-abi3-manylinux2010_x86_64.whl
+Source1030: typing_extensions-4.12.2.tar.gz
 # google
-Source1032: cachetools-4.2.2-py3-none-any.whl
-Source1033: chardet-3.0.4-py2.py3-none-any.whl
-Source1034: google_api_core-1.30.0-py2.py3-none-any.whl
-Source1035: google_api_python_client-1.12.8-py2.py3-none-any.whl
-Source1036: googleapis_common_protos-1.53.0-py2.py3-none-any.whl
-Source1037: google_auth-1.32.0-py2.py3-none-any.whl
-Source1038: google_auth_httplib2-0.1.0-py2.py3-none-any.whl
-Source1039: httplib2-0.19.1-py3-none-any.whl
-Source1040: packaging-20.9-py2.py3-none-any.whl
-Source1041: protobuf-3.17.3-cp39-cp39-manylinux_2_5_x86_64.manylinux1_x86_64.whl
-Source1042: pyasn1-0.4.8-py2.py3-none-any.whl
-Source1043: pyasn1_modules-0.2.8-py2.py3-none-any.whl
-Source1044: pyparsing-2.4.7-py2.py3-none-any.whl
-Source1045: pyroute2-0.7.12.tar.gz
-Source1046: pyroute2.core-0.6.13.tar.gz
-Source1047: pyroute2.ethtool-0.6.13.tar.gz
-Source1048: pyroute2.ipdb-0.6.13.tar.gz
-Source1049: pyroute2.ipset-0.6.13.tar.gz
-Source1050: pyroute2.ndb-0.6.13.tar.gz
-Source1051: pyroute2.nftables-0.6.13.tar.gz
-Source1052: pyroute2.nslink-0.6.13.tar.gz
-Source1053: pytz-2021.1-py2.py3-none-any.whl
-Source1054: rsa-4.7.2-py3-none-any.whl
-Source1055: setuptools-71.1.0.tar.gz
-Source1056: uritemplate-3.0.1-py2.py3-none-any.whl
+Source1031: cachetools-4.2.2-py3-none-any.whl
+Source1032: chardet-3.0.4-py2.py3-none-any.whl
+Source1033: google_api_core-1.30.0-py2.py3-none-any.whl
+Source1034: google_api_python_client-1.12.8-py2.py3-none-any.whl
+Source1035: googleapis_common_protos-1.53.0-py2.py3-none-any.whl
+Source1036: google_auth-1.32.0-py2.py3-none-any.whl
+Source1037: google_auth_httplib2-0.1.0-py2.py3-none-any.whl
+Source1038: httplib2-0.19.1-py3-none-any.whl
+Source1039: packaging-20.9-py2.py3-none-any.whl
+Source1040: protobuf-3.17.3-cp39-cp39-manylinux_2_5_x86_64.manylinux1_x86_64.whl
+Source1041: pyasn1-0.4.8-py2.py3-none-any.whl
+Source1042: pyasn1_modules-0.2.8-py2.py3-none-any.whl
+Source1043: pyparsing-2.4.7-py2.py3-none-any.whl
+Source1044: pyroute2-0.7.12.tar.gz
+Source1045: pyroute2.core-0.6.13.tar.gz
+Source1046: pyroute2.ethtool-0.6.13.tar.gz
+Source1047: pyroute2.ipdb-0.6.13.tar.gz
+Source1048: pyroute2.ipset-0.6.13.tar.gz
+Source1049: pyroute2.ndb-0.6.13.tar.gz
+Source1050: pyroute2.nftables-0.6.13.tar.gz
+Source1051: pyroute2.nslink-0.6.13.tar.gz
+Source1052: pytz-2021.1-py2.py3-none-any.whl
+Source1053: rsa-4.7.2-py3-none-any.whl
+Source1054: setuptools-71.1.0.tar.gz
+Source1055: uritemplate-3.0.1-py2.py3-none-any.whl
 # common (pexpect / suds)
-Source1057: pexpect-4.8.0-py2.py3-none-any.whl
-Source1058: ptyprocess-0.7.0-py2.py3-none-any.whl
-Source1059: suds_community-0.8.5-py3-none-any.whl
+Source1056: pexpect-4.8.0-py2.py3-none-any.whl
+Source1057: ptyprocess-0.7.0-py2.py3-none-any.whl
+Source1058: suds_community-0.8.5-py3-none-any.whl
 ### END ###
 # kubevirt
 ## pip download --no-binary :all: openshift "ruamel.yaml.clib>=0.1.2"
@ -180,8 +179,7 @@ Source1083: poetry-core-1.0.7.tar.gz
 Source1084: pyparsing-3.0.1.tar.gz
 Source1085: tomli-2.0.1.tar.gz
 Source1086: flit_core-3.9.0.tar.gz
-Source1087: typing_extensions-4.12.2.tar.gz
-Source1088: wheel-0.37.0-py2.py3-none-any.whl
+Source1087: wheel-0.37.0-py2.py3-none-any.whl
 ### END

 Patch0: ha-cloud-support-aliyun.patch
@ -246,6 +244,7 @@ Patch58: RHEL-59878-fence_scsi-only-preempt-once-for-mpath-devices.patch
 Patch59: RHEL-56138-fence_mpath-1-support-hex-key-format.patch
 Patch60: RHEL-56138-fence_mpath-2-fix-unfencing-issue-use-MULTILINE-avoid-duplicates.patch
 Patch61: RHEL-62206-fence_ibm_powervs-add-private-endpoint-and-token-file-support.patch
+Patch62: RHEL-76492-fence_azure_arm-use-azure-identity.patch

 ### HA support libs/utils ###
 # all archs
@ -428,6 +427,7 @@ BuildRequires: %{systemd_units}
 %patch -p1 -P 59
 %patch -p1 -P 60
 %patch -p1 -P 61
+%patch -p1 -P 62

 # prevent compilation of something that won't get used anyway
 sed -i.orig 's|FENCE_ZVM=1|FENCE_ZVM=0|' configure.ac
@ -632,22 +632,32 @@ Provides: bundled(python-s3transfer) = 0.4.2
 Provides: bundled(python-urllib3) = 1.26.18
 # azure
 Provides: bundled(python-adal) = 1.2.7
-Provides: bundled(python-azure-common) = 1.1.27
-Provides: bundled(python-azure-core) = 1.15.0
-Provides: bundled(python-azure-mgmt-compute) = 21.0.0
-Provides: bundled(python-azure-mgmt-core) = 1.2.2
-Provides: bundled(python-azure-mgmt-network) = 19.0.0
-Provides: bundled(python-certifi) = %{certifi_version}
+Provides: bundled(python-azure-common) = 1.1.28
+Provides: bundled(python-azure-core) = 1.32.0
+Provides: bundled(python-azure-identity) = 1.19.0
+Provides: bundled(python-azure-mgmt-compute) = 34.0.0
+Provides: bundled(python-azure-mgmt-core) = 1.5.0
+Provides: bundled(python-azure-mgmt-network) = 28.1.0
 Provides: bundled(python-chardet) = 4.0.0
+Provides: bundled(python-cffi) = 1.14.5
+Provides: bundled(python-%{chrstnormalizer}) = %{chrstnormalizer_version}
 Provides: bundled(python-cryptography) = 3.3.2
-Provides: bundled(python-idna) = 2.10
-Provides: bundled(python-isodate) = 0.6.0
-Provides: bundled(python-msrest) = 0.6.21
-Provides: bundled(python-msrestazure) = 0.6.4
-Provides: bundled(python-oauthlib) = 3.1.1
+Provides: bundled(python-dateutil) = 2.8.1
+Provides: bundled(python-%{idna}) = %{idna_version}
+Provides: bundled(python-isodate) = 0.6.1
+Provides: bundled(python-msal) = 1.31.1
+Provides: bundled(python-msal-extensions) = 1.2.0
+Provides: bundled(python-msrest) = 0.7.1
+Provides: bundled(python-msrestazure) = 0.6.4.post1
+Provides: bundled(python-%{oauthlib}) = %{oauthlib_version}
+Provides: bundled(python-portalocker) = 2.5.1
+Provides: bundled(python-pycparser) = 2.20
 Provides: bundled(python-PyJWT) = 2.1.0
-Provides: bundled(python-requests) = 2.25.1
+Provides: bundled(python-%{requests}) = %{requests_version}
 Provides: bundled(python-requests-oauthlib) = 1.3.0
+Provides: bundled(python-%{six}) = %{six_version}
+Provides: bundled(python-typing-extensions) = 4.12.2
+Provides: bundled(python-%{urllib3}) = %{urllib3_version}
 # google
 Provides: bundled(python-cachetools) = 4.2.2
 Provides: bundled(python-chardet) = 3.0.4
@ -1524,6 +1534,11 @@ are located on corosync cluster nodes.
 %endif

 %changelog
+* Fri Jan 31 2025 Oyvind Albrigtsen <oalbrigt@redhat.com> - 4.10.0-84
+- fence_azure_arm: use azure-identity instead of msrestazure, which has
+  been deprecated
+  Resolves: RHEL-76493
+
 * Wed Jan  8 2025 Oyvind Albrigtsen <oalbrigt@redhat.com> - 4.10.0-83
 - bundled jinja2: fix CVE-2024-56201 and CVE-2024-56326
  Resolves: RHEL-72074, RHEL-72067
--- a/28
+++ b/28
@ -20,27 +20,26 @@ SHA512 (botocore-1.20.102-py2.py3-none-any.whl) = 067d5828bfdafe72f5f641e2141fa6
 SHA512 (python_dateutil-2.8.1-py2.py3-none-any.whl) = ff083825ef3c8a3c6887ceae79a4249b938f529b72d0b931b1e30c81856ec7c8ee0adf0e29e2a41d3c76ab4e1faabc1c4161fe977d14589d346a658e343aa122
 SHA512 (s3transfer-0.4.2-py2.py3-none-any.whl) = f0616baf3dff4a829e791593ed90406828b0a429690d5939a1bf216776fd35674d314175e8261627f707545f53f36d927458767517cac1d18066f02ff7b56681
 SHA512 (urllib3-1.26.18.tar.gz) = c89e93a032bf6b11375c06ef7c5abc1868f93e7655cfdca09e9bd939ad415d206ea159fe151ecd2e5f725e0e18a831c7a5382ad01dbc32264154fc8af7aec156
-SHA512 (adal-1.2.7-py2.py3-none-any.whl) = 81e2b0b99fdb5b865ed8126a796e47f28032ed59d82da4ce1ca8743c4ea26afa58ad12bae25a22b0dc3baab80a369a08427fc688f1408e2fbc2b1a264819447b
-SHA512 (azure_common-1.1.27-py2.py3-none-any.whl) = 4871d9155c46d79b9f8851814c6a4aff4191ebf747e2157e195de9aff3a3a6cd674b18f93c497f5fd59ee3ac7b3e1d72501fc27ccac8b49b985f7ace70b92061
-SHA512 (azure_core-1.15.0-py2.py3-none-any.whl) = 89ea0646d3571841e841255e13f7f4b60838c96c39e8ecb1ae5336822d21307b592e1a1e5da413b2b484c51b51e5de5fb1a7031a10cec9698cc6472bcdc10406
-SHA512 (azure_mgmt_compute-21.0.0-py2.py3-none-any.whl) = e02fe9e100d898f4bbc14f59c9ccb225ca38a82ea7f864c0c662572376f32ed0524d01b4f64ac6325ce97b7218fa702f9191c6d96917771f85a23aa0c972767d
-SHA512 (azure_mgmt_core-1.2.2-py2.py3-none-any.whl) = ea0b4062314de37d048cf6d9e40757372e050291a8861719dda2f1446c2e9a932050d0c0f732a8afb182993b7f700b5d6053217801199a4257b6269f5c7e47e5
-SHA512 (azure_mgmt_network-19.0.0-py2.py3-none-any.whl) = aa18ed97f167a1abf60c8fd7ae81b6777565c13f8ace06c81cdc70bf16c9fc2efad1984b8f159877ba3118312d2b81759df3b8e42b6f874cea5214943e8b054d
-SHA512 (azure-identity-1.10.0.zip) = 66551765ac0a4d43dc95cb755be3bfc31e2e7afa7eebf72c061c6c7d1dd0cf88988d88a39c2c1463fe27caced7ccd72da6520a9e977bfed0ee5f495fe00fab6a
+SHA512 (adal-1.2.7.tar.gz) = b46dd3ebb72123e9c2d2eb75eae17b1175f09908b44430131251b0deb0f96f4f3646aa5c0553894c89e664d448ad90bf7436a0a48e18b6a2eff491dad3d8a8a8
+SHA512 (azure-common-1.1.28.zip) = cfa8d08e11ff7d855342a589f9780ba1b2386fd63cddcbcc04d83be8d4d8e41dceba494b617e27ed4e3da4366b9f1203819ec391ef4466a6700cc2c8b85f0c38
+SHA512 (azure_core-1.32.0.tar.gz) = a1b975e5f9560b5a9b0800c7cd41afc8040582f9b5e73aeb9216f7b076b3821337b741a5f5b7b183008108552dd62da120e0f8334492a06ea729188c85ffcbc0
+SHA512 (azure_mgmt_compute-34.0.0.tar.gz) = 038ccac0792000778386769f81b908e35865ce20fc29d9d95e1ee774442d31b14162cdc7fed8dfcf4b7ef592a15d302968eca63ccc4363da3404e2ad53756254
+SHA512 (azure_mgmt_core-1.5.0.tar.gz) = ac88496015552ee473ebf8c7fe312bc7e79f10b33019c8a9d51e32cdcb237e8db45a5cc6bbbd94ca87bfc9090954417dd64c674847a78765377cb61468fd9987
+SHA512 (azure_mgmt_network-28.1.0.tar.gz) = 43acf01c26efbb40a877feafeba659f27a4e903b3d2bbc01dcbf3e880d1ab4d9cca551b8ffb46ea939c3630221b6881f854213cfce7bcd5194b7593c506a7f59
+SHA512 (azure_identity-1.19.0.tar.gz) = a0df8139b82cfb4f1887c340d8637f80575088e699106285ceca1211b884bc7154f237b279e9b086740a3fb9cc98f714613ab7ae98cf6eff08a48b32691c7de8
 SHA512 (certifi-2023.7.22.tar.gz) = 220ec0a4251f301f057b4875e5966a223085b0c764c911450b43df7f49dbc5af50f14eeb692d935c0baa95d7c800055fa03efa4aaabba397a82c7b07c042bd90
 SHA512 (chardet-4.0.0-py2.py3-none-any.whl) = cc8cdd5e73b4eace0131bbeaf6099e322ba5c2f827f26ad3316c674c60529d77f39f68d9fb83199ab78d16902021ab1ae58d74ab62d770cf95ceb804b9242e90
-SHA512 (idna-2.10-py2.py3-none-any.whl) = 7b7be129e1a99288aa74a15971377cb17bee1618843c03c8f782e287d0f3ecf3b8f26e3ea736444eb358f1d6079131a7eb291446f3279874eb8e00b624d9471c
-SHA512 (isodate-0.6.0-py2.py3-none-any.whl) = 6d39a350ff4af87c74ae3226e6627f9c254205bfd2a761a5bf956883667bbe6d4678e1830b629c899a6f0fe67a9603cb4890c5a1fa6c8d245fe4fdbddddde870
-SHA512 (msrest-0.6.21-py2.py3-none-any.whl) = 331070553409fb006726d90667822951188712a2671fd00b5304e12341db0a5c529660b630b5ad2584214ee48ae32a0a2ffbfe43ede3d0639ee176bac0f4c15b
-SHA512 (msrestazure-0.6.4-py2.py3-none-any.whl) = aa4329e3a6ba639d0061c1eb0712b9d474d49ca9d7c8d41f02e44089c9efa3bf37075d52942841c3431b3afead51b9bc73193b087f4fd6672131d8e3b6c9cb86
-SHA512 (msal-1.18.0.tar.gz) = 70e7753dd9a218589c6082c2c706365e421e65476c5775db4abca52e1ca88ec02fd800fe885e3849a91ba2f4690d4acc8736d99e4320fad012c8ba411b0ef068
-SHA512 (msal-extensions-1.0.0.tar.gz) = 5dc22a64a535ac9c7488d0d1e85e2f8320cb5c9e4cb5891599c8fc07060ff1eac310fe93ef42416142600ade8666ac4f0a3614a3e81950311f6d752cac5de959
+SHA512 (isodate-0.6.1.tar.gz) = 437e420ec7ee68dedded825f30d3289eeb0da526208443e5a8e50fe70f12309515e1285b21132d26e6d4c1683f90dfa1d401582042b5e4381fe7ab0e34af26b6
+SHA512 (msrest-0.7.1.zip) = 430e982adf89c79356e59182587c62ecb935e983f2e339738b54c48d0cd3cfa66ab48aad52d342b3efe5938d5e02693f24d603a4d637e3e5818bac6d03cc19db
+SHA512 (msrestazure-0.6.4.post1.tar.gz) = 8fc4eba2520cecae612e9f1ab279662a1b531c73da3ee9af5abf59bc478b4edbf7ce0ea17d4491ff498d17269c31a82a9327eea4d1f1c704a4a7f434ef284acb
+SHA512 (msal-1.31.1.tar.gz) = 2d52681bf2229d9a87c195c777e90b4a1b567355ceba91a93220483bbea6ab108bfb934c70b3a60080c7cc3ecd4a07cae39ece3891c38e3c4cff77560875fee3
+SHA512 (msal_extensions-1.2.0.tar.gz) = 8a56049bfb0c8237fe81f6d39c3368bb1c79ee9fcb211382f8b407ba89cea4f9405a2a4e54ef7f817b2d59091a036440009c2c5858e44da5cf790c1a97fef17e
 SHA512 (portalocker-2.5.1.tar.gz) = a1aeea4cb09a05d4fc65a346965b5af509963f84c6b440bed974770576cab8d5c94c8535f2debd72613f3c603cf9fe3cc236fac6bec2fd69d7d48d206ba4c344
 SHA512 (cryptography-3.3.2-cp36-abi3-manylinux2010_x86_64.whl) = d6cb4ee14cdfbf17226c5caec3ee182c1e812b6630dcab07dc5869d29a828f0fded2c2e2d85be2c5952dc2b1c0a0cedcd01d520f3e1c4aa385badb07a17d62c4
 SHA512 (oauthlib-3.2.2.tar.gz) = c147b96e0ab0d1a8845f525e80831cfd04495134dd1f17fd95eac62f3a95c91e6dca9d38e34206537d77f3c12dd5b553252239318ba39546979c350e96536b8b
 SHA512 (PyJWT-2.1.0-py3-none-any.whl) = d2f632379ecb3eb9c02d67f6da30d0c363f439936b5a6bc1172a0a33dc7e4784ee8b10c258d24ac40b5efbb252e7921c0842699f4b2d40eff99333557b531fcc
-SHA512 (requests-2.25.1-py2.py3-none-any.whl) = cc0afada76d46295c685ac060d15a1ccb9af671522cb7b4fa0ad11988853715d1b7c31d42fa1e72a576cbd775db174da5bc03ab25c1e31c234c37740a63a6bcf
 SHA512 (requests_oauthlib-1.3.0-py2.py3-none-any.whl) = 17d5e66d174e57ef1dae451a20bce215a3cc3d7ab1a5b922d4a66cb49b497c9a0799bd90b5a378648335daee7cf80f843f065d90410bfa791f989f76300a02d7
+SHA512 (typing_extensions-4.12.2.tar.gz) = b06f26ae55194f37ee48dcb894bf583051c9e74f639f25195990f56330eae7b585ab4b8655ca575539f48254c20f1920628db6db10512953d1f6364e3c076a27
 SHA512 (cachetools-4.2.2-py3-none-any.whl) = 4e585eda01b37ca6a2e1e6aadc0ceb8a789811357806b3ab2a76180d89496b6608c8aaaa4a44dc11785850236493daff646b1f04759bc4dc78c7b76c977feb09
 SHA512 (chardet-3.0.4-py2.py3-none-any.whl) = bfae58c8ea19c87cc9c9bf3d0b6146bfdb3630346bd954fe8e9f7da1f09da1fc0d6943ff04802798a665ea3b610ee2d65658ce84fe5a89f9e93625ea396a17f4
 SHA512 (google_api_core-1.30.0-py2.py3-none-any.whl) = b024d8612de3ad6f903a1c376b84f03dcddd0cf5c4078749bbd6b0d2231a3ef1e968dcb5621b6470972b116d6aaff5d05deab79ed4a2873c29eec74c37778916
@ -95,5 +94,4 @@ SHA512 (poetry-core-1.0.7.tar.gz) = 0d93daefd7cb785059d1faa04b347cbaa908e0698d59
 SHA512 (pyparsing-3.0.1.tar.gz) = 4a91daaf962a4d689ac26a712a83e8c4fbebc33270b6e46f0ae34fe247f6858d6334fbb59bdbbafa448703d24763fe1c86ce164e095de5003c7f1390960ba520
 SHA512 (tomli-2.0.1.tar.gz) = fd410039e255e2b3359e999d69a5a2d38b9b89b77e8557f734f2621dfbd5e1207e13aecc11589197ec22594c022f07f41b4cfe486a3a719281a595c95fd19ecf
 SHA512 (flit_core-3.9.0.tar.gz) = 1205589930d2c51d6aa6b2533a122a912e63b157e94adba2a0649a58d324fa98a5b84609d9b53e9d236f1cdb6a6984de2cefcf2f11abc2cd83956df21f269ad6
-SHA512 (typing_extensions-4.12.2.tar.gz) = b06f26ae55194f37ee48dcb894bf583051c9e74f639f25195990f56330eae7b585ab4b8655ca575539f48254c20f1920628db6db10512953d1f6364e3c076a27
 SHA512 (wheel-0.37.0-py2.py3-none-any.whl) = 340ab4ad7337db653b173f4283fdacc3d5e8b3a1b133e3017d53c41f79f0cf7b327d8f530d07a0344435c4ffcdb10d36a4881586e6637658b70f88835ca8afa7