test(e2e): use workload identity webhook label instead of manual injection - #4515
test(e2e): use workload identity webhook label instead of manual injection#4515Ben Vesel (bennerv) wants to merge 1 commit into
Conversation
…ction Now that the Azure workload identity webhook is available as a KAS sidecar (CNTRLPLANE-2910), use the `azure.workload.identity/use` pod label so the webhook automatically injects the required env vars, volume, and volume mount. Remove the manual configuration that was serving as a workaround. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
There was a problem hiding this comment.
Pull request overview
Updates the OIDC workload identity E2E test to rely on the Azure workload identity webhook (now available as a KAS sidecar) instead of manually injecting federated token env/volume configuration.
Changes:
- Add the
azure.workload.identity/use: "true"label to the test pod to trigger webhook injection. - Remove the manually configured projected token volume, volume mount, and explicit AZURE_* env vars from the test pod spec.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
|
/test e2e-parallel |
|
I've been told that #4592 has the changes to make this PR work. Kicked off an e2e. |
|
/lgtm |
|
/test e2e-parallel |
|
/lgtm cancel |
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: bennerv The full list of commands accepted by this bot can be found here. The pull request process is described here DetailsNeeds approval from an approver in each of these files:
Approvers can indicate their approval by writing |
|
this will be the one with the hypershift webhook changes |
|
/retest |
|
replaced by #4627 |
What
Use the
azure.workload.identity/usepod label in the OIDC workload identity e2e test so the webhook automatically injects the required env vars, volume, and volume mount. Remove the manual configuration that was serving as a workaround.Why
The Azure workload identity webhook is now available as a KAS sidecar (CNTRLPLANE-2910), so the manual env var, volume, and volume mount injection is no longer needed. This resolves the TODOs left in the test.
Special notes for your reviewer
The
az logincommand in the pod still references$AZURE_CLIENT_ID,$AZURE_TENANT_ID, and$AZURE_FEDERATED_TOKEN_FILE— these are now expected to be injected by the webhook rather than set manually.