Skip to content

implement identity bindings #5083

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
Mitch Connors (therealmitchconnors) wants to merge 4 commits into
base: main
Choose a base branch
from
Open

implement identity bindings #5083

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
720efe1
implement identity bindings #3456
therealmitchconnors Aug 18, 2026
94ce107
add addrs to cspell words
therealmitchconnors Aug 24, 2026
351e0b6
apply pr feedback
therealmitchconnors Aug 24, 2026
db13a1f
removed CA caching per PR feedback
therealmitchconnors Aug 24, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
5 changes: 4 additions & 1 deletion .vscode/cspell.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -24,6 +24,7 @@
"aarch",
"accountendpoint",
"accountkey",
"addrs",

@heaths Heath Stewart (heaths) Aug 25, 2026

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Service directory "misspellings" should go into sdk/identity/.cspell.json. There are agent instructions that help do this e.g., the /check-spelling skill.

"agentic",
"amqp",
"asyncoperation",
Expand All @@ -35,6 +36,7 @@
"checkpointstore",
"clippy",
"codeowners",
"commonname",
"contoso",
"cplusplus",
"cpptools",
Expand Down Expand Up @@ -79,6 +81,7 @@
"pageables",
"pkce",
"pkcs",
"pkey",
"posix",
"pullrequest",
"pwsh",
Expand Down Expand Up @@ -159,4 +162,4 @@
]
}
]
}
}
1 change: 1 addition & 0 deletions Cargo.lock
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

1 change: 1 addition & 0 deletions sdk/identity/azure_identity/CHANGELOG.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,6 +5,7 @@
### Features Added

- Added support for Arc-connected servers when using the `ManagedIdentityCredential`.
- Added opt-in AKS identity binding support to `WorkloadIdentityCredentialOptions` through `enable_azure_proxy`.

@heaths Heath Stewart (heaths) Aug 25, 2026

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I recommend spelling out "AKS" in any documentation at least the first time it's used. Better for SEO and for people who may not be as familiar with it.


### Breaking Changes

Expand Down
4 changes: 3 additions & 1 deletion sdk/identity/azure_identity/Cargo.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -19,6 +19,7 @@ azure_core = { path = "../../core/azure_core", version = "1.2.0-beta.1", default
futures.workspace = true
openssl = { workspace = true, optional = true }
pin-project.workspace = true
reqwest = { workspace = true, optional = true, features = ["rustls"] }
serde.workspace = true
serde_json.workspace = true
time.workspace = true
Expand All @@ -39,7 +40,8 @@ tokio.workspace = true
tracing-subscriber.workspace = true

[features]
default = ["azure_core/default"]
default = ["azure_core/default", "azure_proxy"]
azure_proxy = ["dep:reqwest", "azure_core/reqwest_rustls"]

@heaths Heath Stewart (heaths) Aug 25, 2026

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

  1. Can you describe this more?
  2. No need to repeat "azure". It's a feature in an azure_* crate already. No other crate does that.

tokio = ["dep:tokio", "azure_core/tokio", "tokio/process"]
client_certificate = ["openssl"]

Expand Down
4 changes: 4 additions & 0 deletions sdk/identity/azure_identity/TROUBLESHOOTING.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -197,6 +197,10 @@ azd auth token --output json --scope https://management.core.windows.net/.defaul
| Error Message |Description| Mitigation |
|---|---|---|
|no client ID/tenant ID/token file specified|Incomplete configuration|In most cases these values are provided via environment variables set by Azure Workload Identity.<ul><li>If your application runs on Azure Kubernetes Service (AKS) or a cluster that has deployed the Azure Workload Identity admission webhook, check pod labels and service account configuration. See the [AKS documentation](https://learn.microsoft.com/azure/aks/workload-identity-deploy-cluster#disable-workload-identity) and [Azure Workload Identity troubleshooting guide](https://azure.github.io/azure-workload-identity/docs/troubleshooting.html) for more details.<li>If your application isn't running on AKS or your cluster hasn't deployed the Workload Identity admission webhook, set these values in `WorkloadIdentityCredentialOptions`
|invalid `AZURE_KUBERNETES_TOKEN_PROXY`|The AKS identity binding proxy endpoint is malformed or doesn't use HTTPS.|Use an HTTPS URL with a host and no user information, query, or fragment. Set `enable_azure_proxy` to `true` only when using [AKS identity bindings](https://learn.microsoft.com/azure/aks/identity-bindings-concepts).|
|`AZURE_KUBERNETES_TOKEN_PROXY` is not set but another proxy variable is present|The proxy has auxiliary TLS configuration but no endpoint.|Set `AZURE_KUBERNETES_TOKEN_PROXY`, or remove `AZURE_KUBERNETES_SNI_NAME`, `AZURE_KUBERNETES_CA_FILE`, and `AZURE_KUBERNETES_CA_DATA`. These variables are ignored when `enable_azure_proxy` is `false`.|
|invalid `AZURE_KUBERNETES_CA_FILE` or `AZURE_KUBERNETES_CA_DATA`|The configured CA certificate can't be read or parsed, or both CA sources are set.|Set at most one CA source. Ensure `AZURE_KUBERNETES_CA_FILE` points to a readable, nonempty PEM certificate bundle or provide the PEM bundle in `AZURE_KUBERNETES_CA_DATA`.|
|failed to resolve `AZURE_KUBERNETES_TOKEN_PROXY` host|The proxy host can't be resolved while custom SNI is configured.|Verify the proxy hostname is resolvable from the pod and that `AZURE_KUBERNETES_SNI_NAME` contains the TLS server name presented by the cluster endpoint.|

<a id="apc"></a>
## Troubleshoot `AzurePipelinesCredential` authentication issues
Expand Down
Loading
Loading