Support for Azure workload identity in AKS and Arc clusters (#141)#508
Merged
Conversation
* feat(src): add Azure service account and extra pod labels configuration - implement service account creation with customizable name and annotations - enhance service templates to support extra pod labels for various services - update Azure backend to utilize DefaultAzureCredential for authentication - add tests for Azure credential extraction and client creation * feat(src): extract account key from connection string for Azure Blob Storage - add function to extract AccountKey from connection string - update AzureBlobStorageClient to handle different credential types * feat(test): add tests for account key extraction from Azure connection strings * chore: clean up linting issues for tests * refactor(src): update data credential types in PostgresConnector and TaskGroup - change StaticDataCredential to DataCredential in get_all_data_creds method - update fetch_creds function signature to use DataCredential * feat(src): update Azure client creation to include storage account and account URL - remove deprecated storage account extraction function - modify create_client to accept storage_account and account_url parameters - update AzureBlobStorageClientFactory to use new parameters - adjust tests to reflect changes in client creation 🔒 - Generated by Copilot * refactor(src): mark storage_account parameter as unused in create_client function 🔧 - Generated by Copilot * refactor(src): remove unused storage_account parameter from client creation 🔧 - Generated by Copilot
elookpotts-nvidia
temporarily deployed
to
internal-ci
GitHub Actions
Inactive
fernandol-nvidia
approved these changes
Feb 24, 2026
This was referenced Mar 29, 2026
3 tasks
vvnpn-nv
added a commit
that referenced
this pull request
May 26, 2026
* release notes: 6.3.0 — add workload identity support PR #508 (Feb 2026) added a cloud-neutral workload-identity hook to the service chart — top-level serviceAccount block (create, name, annotations) plus per-component extraPodLabels on agent, api, worker, logger, router, and delayedJobMonitor. The Azure storage backend gained DefaultAzureCredential fallback in the same PR; the S3 backend already supported keyless auth via boto3's default credential chain. End-to-end this enables: - Azure: AKS Workload Identity / Arc clusters via UAMI annotation + WI label - AWS: EKS IRSA / Pod Identity via role-arn annotation GCS/Swift/TOS backends still require static credentials — flagged as a caveat so users don't assume keyless works everywhere. These were in 6.3.0 code but missing from the release notes — adding a Highlights bullet and a detailed Helm Charts entry. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * update --------- Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Cherry-pick #141
feat(test): add tests for account key extraction from Azure connection strings
chore: clean up linting issues for tests
refactor(src): update data credential types in PostgresConnector and TaskGroup
🔒 - Generated by Copilot
🔧 - Generated by Copilot
🔧 - Generated by Copilot
Description
Issue #None
Checklist