azure: support any OIDC issuer for workload identity setup#35
Open
Avi-Robusta wants to merge 1 commit into
Open
azure: support any OIDC issuer for workload identity setup#35Avi-Robusta wants to merge 1 commit into
Avi-Robusta wants to merge 1 commit into
Conversation
Generalize the single-cluster Azure workload-identity setup so it works with any OIDC issuer (AWS EKS, GKE, self-managed), not only AKS. - Add --oidc-issuer <url>; when provided, skip the AKS-specific `az aks update`/`az aks show` calls and federate the managed identity directly to that issuer. - Keep the existing derive-from-AKS path when --oidc-issuer is omitted (requires --aks-cluster). - --resource-group is still required (holds the managed identity). - Add an EKS example and note that non-AKS clusters must project a service account token with audience api://AzureADTokenExchange. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Generalizes the single-cluster Azure workload-identity setup (
servers/azure/setup-azure-identity.sh) so it federates to any OIDC issuer — AWS EKS, GKE, self-managed, or AKS — instead of assuming AKS.Why
The workload-identity path previously derived the OIDC issuer from an AKS cluster (
az aks update/az aks show), so it only worked on AKS. Users running Holmes on non-AKS clusters (e.g. AWS EKS) couldn't use secretless workload identity for the Azure MCP.Changes
--oidc-issuer <url>. When provided, the script skips the AKS-specific calls and federates the managed identity directly to that issuer.--oidc-issueris omitted: derive the issuer from--aks-cluster(and enable AKS workload identity).--resource-groupremains required (it holds the managed identity in Azure);--aks-clusteris now only needed for the derive-from-AKS path.--helpexample and a comment noting that non-AKS clusters must project a service account token with audienceapi://AzureADTokenExchange(no AKS webhook to inject it).The federated-credential creation was already issuer-agnostic (
--issuer "$OIDC_ISSUER"), so only the issuer-resolution logic needed generalizing.Example (EKS)
Testing
bash -npasses.--oidc-issuerprovided → skips AKS calls; neither--oidc-issuernor--aks-cluster→ clear error.Note
This scopes to the setup script only. The single-account Helm deployment template still relies on the AKS webhook to inject the token; end-to-end EKS support in the deployment (manual token projection) is tracked separately.
🤖 Generated with Claude Code