Skip to content

[Identity] Add support for Bridge to Kubernetes to ManagedIdentityCredential #15856

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
sadasant merged 3 commits into from
Jun 28, 2021
Merged

[Identity] Add support for Bridge to Kubernetes to ManagedIdentityCredential #15856

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
a9cd5e0
[Identity] Add support for Bridge to Kubernetes to ManagedIdentityCre…
sadasant Jun 18, 2021
cd809de
one very simple test
sadasant Jun 21, 2021
a39ec19
forgot this line
sadasant Jun 22, 2021
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions sdk/identity/identity/CHANGELOG.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -37,6 +37,7 @@
- `AuthenticationRequiredError` (introduced in 2.0.0-beta.1) now has the same impact on `ChainedTokenCredential` as the `CredentialUnavailableError` which is to allow the next credential in the chain to be tried.
- `ManagedIdentityCredential` now retries with exponential back-off when a request for a token fails with a 404 status code on environments with available IMDS endpoints.
- Added an `AzurePowerShellCredential` which will use the authenticated user session from the `Az.Account` PowerShell module. This credential will attempt to use PowerShell Core by calling `pwsh`, and on Windows it will fall back to Windows PowerShell (`powershell`) if PowerShell Core is not available.
- Added support to `ManagedIdentityCredential` for Bridge to Kubernetes local development authentication.

### Breaking changes from 2.0.0-beta.1

Expand Down
7 changes: 6 additions & 1 deletion sdk/identity/identity/src/credentials/managedIdentityCredential/imdsMsi.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -44,7 +44,7 @@ function prepareRequestOptions(resource?: string, clientId?: string): RequestPre
}

return {
url: imdsEndpoint,
url: process.env.AZURE_POD_IDENTITY_TOKEN_URL ?? imdsEndpoint,
method: "GET",
queryParameters,
headers: {
Expand Down Expand Up @@ -73,6 +73,11 @@ export const imdsMsi: MSI = {
getTokenOptions
);

// if the PodIdenityEndpoint environment variable was set no need to probe the endpoint, it can be assumed to exist
if (process.env.AZURE_POD_IDENTITY_TOKEN_URL) {
return true;
}

const request = prepareRequestOptions(resource, clientId);

// This will always be populated, but let's make TypeScript happy
Expand Down
13 changes: 12 additions & 1 deletion sdk/identity/identity/test/internal/node/managedIdentityCredential.spec.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -15,7 +15,10 @@ import {
import { MockAuthHttpClient, MockAuthHttpClientOptions, assertRejects } from "../../authTestUtils";
import { OAuthErrorResponse } from "../../../src/client/errors";
import Sinon from "sinon";
import { imdsMsiRetryConfig } from "../../../src/credentials/managedIdentityCredential/imdsMsi";
import {
imdsMsi,
imdsMsiRetryConfig
} from "../../../src/credentials/managedIdentityCredential/imdsMsi";
import { mkdtempSync, rmdirSync, unlinkSync, writeFileSync } from "fs";
import { join } from "path";
import { tmpdir } from "os";
Expand All @@ -38,6 +41,7 @@ describe("ManagedIdentityCredential", function() {
delete process.env.MSI_SECRET;
delete process.env.IDENTITY_SERVER_THUMBPRINT;
delete process.env.IMDS_ENDPOINT;
delete process.env.AZURE_POD_IDENTITY_TOKEN_URL;
sandbox = Sinon.createSandbox();
clock = sandbox.useFakeTimers({
now: Date.now(),
Expand All @@ -52,6 +56,7 @@ describe("ManagedIdentityCredential", function() {
process.env.MSI_SECRET = env.MSI_SECRET;
process.env.IDENTITY_SERVER_THUMBPRINT = env.IDENTITY_SERVER_THUMBPRINT;
process.env.IMDS_ENDPOINT = env.IMDS_ENDPOINT;
process.env.AZURE_POD_IDENTITY_TOKEN_URL = env.AZURE_POD_IDENTITY_TOKEN_URL;
sandbox.restore();
clock.restore();
});
Expand Down Expand Up @@ -248,6 +253,12 @@ describe("ManagedIdentityCredential", function() {
);
});

it("IMDS MSI skips verification if the AZURE_POD_IDENTITY_TOKEN_URL environment variable is available", async function() {
process.env.AZURE_POD_IDENTITY_TOKEN_URL = "token URL";

assert.ok(await imdsMsi.isAvailable());
});

// Unavailable exception throws while IMDS endpoint is unavailable. This test not valid.
// it("can extend timeout for IMDS endpoint", async function() {
// // Mock a timeout so that the endpoint ping fails
Expand Down