adding workload identity support for vn2

[SethHollandsworth]

Adding workload identity support. There are 4 env vars and 1 mount. The mount is already added by default at /serviceaccount so all we needed to do was add the env vars.

[ksayid]

in diff mode, if the difference in policy is due to the workload identity label, the user will get a list of the env vars that are added due to workload identity.

{
  "skr2": {
    "env_rules": [
      "environment variable with rule 'AZURE_CLIENT_ID=.+' is not in the policy",
      "environment variable with rule 'AZURE_TENANT_ID=.+' is not in the policy",
      "environment variable with rule 'AZURE_FEDERATED_TOKEN_FILE=.+' is not in the policy",
      "environment variable with rule 'AZURE_AUTHORITY_HOST=.+' is not in the policy"
    ]
  }
}

do you think the error message should make it more clear that these env vars are linked to the workload identity label azure.workload.identity/use: "true"

[SethHollandsworth]

in diff mode, if the difference in policy is due to the workload identity label, the user will get a list of the env vars that are added due to workload identity.

{
  "skr2": {
    "env_rules": [
      "environment variable with rule 'AZURE_CLIENT_ID=.+' is not in the policy",
      "environment variable with rule 'AZURE_TENANT_ID=.+' is not in the policy",
      "environment variable with rule 'AZURE_FEDERATED_TOKEN_FILE=.+' is not in the policy",
      "environment variable with rule 'AZURE_AUTHORITY_HOST=.+' is not in the policy"
    ]
  }
}

do you think the error message should make it more clear that these env vars are linked to the workload identity label azure.workload.identity/use: "true"

That sounds like a whole feature in itself. It would need to be done for other things like privileged/unprivileged, debug mode, stdio, zero sidecars, etc. I'll put it on the list of big things to do if there's time available

[ksayid]

LGTM