Add support of workload identity based authorization

[KernelPryanic]

Hello! We're using self-hosted GitHub runners and it would be really nice to have OIDC utilizing the configured workload identity on the runner pod.

[github-actions]

This issue is idle because it has been open for 14 days with no activity.

[YanaXu]

Hi @KernelPryanic ,

We don't have a plan to support AKS pod-identity or workload-identity right now. Could you share more details about your workflow settings with us, to help us understand your situation better? E.g., the reason to choose AKS instead of normal VMs, how you use AKS to run GitHub Aciton in your daily work, etc.
Thanks.

[BenjaminHerbert]

Currently, azure-cli does not seem to support it directly: Azure/azure-cli#26858

They mention a workaround:

az login --federated-token "$(cat $AZURE_FEDERATED_TOKEN_FILE)" --service-principal -u $AZURE_CLIENT_ID -t $AZURE_TENANT_ID

[YanaXu]

@BenjaminHerbert Thanks. Yes, you're right. It's not supported yet.

[Veljen]

how to get this azure_federate_token_file for the shell script task in the azure devops? i need to get this value using the federated service conection details.

[MoChilia]

Post a sample pod template here on how to get AZURE_FEDERATED_TOKEN_FILE

apiVersion: actions.summerwind.dev/v1alpha1
kind: RunnerDeployment
metadata:
  name: <runnerName>
  namespace: <runnerNamespace>
  labels:
      azure.workload.identity/use: "true"
spec:
  replicas: 2
  template:
    spec:
      repository: <Org>/<repo>
      serviceAccountName: <serviceAccountName>
      env:  
      - name: AZURE_FEDERATED_TOKEN_FILE  
        value: <path>/azure-identity-token
      volumeMounts:
      - name: azure-identity-token
        mountPath: <path>
        readOnly: true
      volumes:  
      - name: azure-identity-token  
        projected:  
          sources:  
          - serviceAccountToken:  
              audience: api://AzureADTokenExchange
              expirationSeconds: 3600  
              path: azure-identity-token