Skip to content

Commit 2d42aed

Browse files
dbanckmagodo
dbanck
and
magodo
authored
Backport of Backend/azure: Update go-azure-sdk version to v0.20250131.1134653 (#36680)
* Backend/azure: Update go-azure-sdk version to v0.20250131.1134653 (#36458) * dependencies: update go-azure-sdk to v0.20250131.1134653 * Update backend test for Github and ADO to not rely on the env vars * Setting ado_pipeline_service_connection_id during provider config * Update doc * changelog * Move changelog to new dir structure --------- Co-authored-by: magodo <[email protected]>
1 parent 6ec0a70 commit 2d42aed

File tree

10 files changed

+142
-44
lines changed

10 files changed

+142
-44
lines changed

‎.changes/v1.11/ENHANCEMENTS-20250207-164803.yaml

+5
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
kind: ENHANCEMENTS
2+
body: Azure Backend supports ADO Pipelines OIDC token refresh by using the `oidc_request_url`, `oidc_request_token` and (the new) `ado_pipeline_service_connection_id`.
3+
time: 2025-02-07T16:48:03.902464157+11:00
4+
custom:
5+
Issue: "36458"

‎go.mod

+2-2
Original file line numberDiff line numberDiff line change
@@ -182,8 +182,8 @@ require (
182182
github.com/hashicorp/consul/api v1.13.0 // indirect
183183
github.com/hashicorp/errwrap v1.1.0 // indirect
184184
github.com/hashicorp/go-azure-helpers v0.71.0 // indirect
185-
github.com/hashicorp/go-azure-sdk/resource-manager v0.20241212.1154051 // indirect
186-
github.com/hashicorp/go-azure-sdk/sdk v0.20241212.1154051 // indirect
185+
github.com/hashicorp/go-azure-sdk/resource-manager v0.20250131.1134653 // indirect
186+
github.com/hashicorp/go-azure-sdk/sdk v0.20250131.1134653 // indirect
187187
github.com/hashicorp/go-cty v1.4.1-0.20200414143053-d3edf31b6320 // indirect
188188
github.com/hashicorp/go-immutable-radix v1.0.0 // indirect
189189
github.com/hashicorp/go-multierror v1.1.1 // indirect

‎go.sum

+4-4
Original file line numberDiff line numberDiff line change
@@ -618,10 +618,10 @@ github.com/hashicorp/errwrap v1.1.0 h1:OxrOeh75EUXMY8TBjag2fzXGZ40LB6IKw45YeGUDY
618618
github.com/hashicorp/errwrap v1.1.0/go.mod h1:YH+1FKiLXxHSkmPseP+kNlulaMuP3n2brvKWEqk/Jc4=
619619
github.com/hashicorp/go-azure-helpers v0.71.0 h1:ra3aIRzg01g6MLKQ+yABcb6WJtrqRUDDgyuPLmyZ9lY=
620620
github.com/hashicorp/go-azure-helpers v0.71.0/go.mod h1:BmbF4JDYXK5sEmFeU5hcn8Br21uElcqLfdQxjatwQKw=
621-
github.com/hashicorp/go-azure-sdk/resource-manager v0.20241212.1154051 h1:jFgd3bzeRViGTzicIn9gDw2O/Gk6WjVJCTTefPNOGPY=
622-
github.com/hashicorp/go-azure-sdk/resource-manager v0.20241212.1154051/go.mod h1:XapOZ9HiCtXz3qb5yNFiCuWbOBj2I3WU1K2jwqgK2zA=
623-
github.com/hashicorp/go-azure-sdk/sdk v0.20241212.1154051 h1:4fCKJPSeLVvwl7ZCqU7MOUKyx/M7kl/J6wlw2O3xn40=
624-
github.com/hashicorp/go-azure-sdk/sdk v0.20241212.1154051/go.mod h1:oI5R0fTbBx3K/sJBK5R/OlEy8ozdQjvctxVU9v3EDkc=
621+
github.com/hashicorp/go-azure-sdk/resource-manager v0.20250131.1134653 h1:KuDCZKWoOByX5MUyFRNWLl4Gy6wpZCwJ7Ez1mbUwouo=
622+
github.com/hashicorp/go-azure-sdk/resource-manager v0.20250131.1134653/go.mod h1:AawbnS/Kkp/IURMJVzmvD+Co2zK91lKFqYYDbenCpGU=
623+
github.com/hashicorp/go-azure-sdk/sdk v0.20250131.1134653 h1:Bd+glHUD1mdal1zn0NgoS4wDFhUB8Qfw61j0nZEnC5A=
624+
github.com/hashicorp/go-azure-sdk/sdk v0.20250131.1134653/go.mod h1:oI5R0fTbBx3K/sJBK5R/OlEy8ozdQjvctxVU9v3EDkc=
625625
github.com/hashicorp/go-checkpoint v0.5.0 h1:MFYpPZCnQqQTE18jFwSII6eUQrD/oxMFp3mlgcqk5mU=
626626
github.com/hashicorp/go-checkpoint v0.5.0/go.mod h1:7nfLNL10NsxqO4iWuW6tWW0HjZuDrwkBuEQsVcpCOgg=
627627
github.com/hashicorp/go-cleanhttp v0.5.0/go.mod h1:JpRdi6/HCYpAwUzNwuwqhbovhLtngrth3wmdIIUrZ80=

‎internal/backend/remote-state/azure/backend.go

+14-5
Original file line numberDiff line numberDiff line change
@@ -156,17 +156,24 @@ func New() backend.Backend {
156156
Description: "Allow OpenID Connect to be used for authentication",
157157
},
158158

159+
"ado_pipeline_service_connection_id": {
160+
Type: schema.TypeString,
161+
Optional: true,
162+
DefaultFunc: schema.MultiEnvDefaultFunc([]string{"ARM_ADO_PIPELINE_SERVICE_CONNECTION_ID", "ARM_OIDC_AZURE_SERVICE_CONNECTION_ID"}, nil),
163+
Description: "The Azure DevOps Pipeline Service Connection ID.",
164+
},
165+
159166
"oidc_request_token": {
160167
Type: schema.TypeString,
161168
Optional: true,
162-
DefaultFunc: schema.MultiEnvDefaultFunc([]string{"ARM_OIDC_REQUEST_TOKEN", "ACTIONS_ID_TOKEN_REQUEST_TOKEN"}, ""),
169+
DefaultFunc: schema.MultiEnvDefaultFunc([]string{"ARM_OIDC_REQUEST_TOKEN", "ACTIONS_ID_TOKEN_REQUEST_TOKEN", "SYSTEM_ACCESSTOKEN"}, nil),
163170
Description: "The bearer token for the request to the OIDC provider. For use when authenticating as a Service Principal using OpenID Connect.",
164171
},
165172

166173
"oidc_request_url": {
167174
Type: schema.TypeString,
168175
Optional: true,
169-
DefaultFunc: schema.MultiEnvDefaultFunc([]string{"ARM_OIDC_REQUEST_URL", "ACTIONS_ID_TOKEN_REQUEST_URL"}, ""),
176+
DefaultFunc: schema.MultiEnvDefaultFunc([]string{"ARM_OIDC_REQUEST_URL", "ACTIONS_ID_TOKEN_REQUEST_URL", "SYSTEM_OIDCREQUESTURI"}, nil),
170177
Description: "The URL for the OIDC provider from which to request an ID token. For use when authenticating as a Service Principal using OpenID Connect.",
171178
},
172179

@@ -329,9 +336,10 @@ func (b *Backend) configure(ctx context.Context) error {
329336
ClientCertificatePassword: data.Get("client_certificate_password").(string),
330337
ClientSecret: *clientSecret,
331338

332-
OIDCAssertionToken: *oidcToken,
333-
GitHubOIDCTokenRequestURL: data.Get("oidc_request_url").(string),
334-
GitHubOIDCTokenRequestToken: data.Get("oidc_request_token").(string),
339+
OIDCAssertionToken: *oidcToken,
340+
OIDCTokenRequestURL: data.Get("oidc_request_url").(string),
341+
OIDCTokenRequestToken: data.Get("oidc_request_token").(string),
342+
ADOPipelineServiceConnectionID: data.Get("ado_pipeline_service_connection_id").(string),
335343

336344
CustomManagedIdentityEndpoint: data.Get("msi_endpoint").(string),
337345

@@ -341,6 +349,7 @@ func (b *Backend) configure(ctx context.Context) error {
341349
EnableAuthenticatingUsingManagedIdentity: enableManagedIdentity,
342350
EnableAuthenticationUsingOIDC: enableOidc,
343351
EnableAuthenticationUsingGitHubOIDC: enableOidc,
352+
EnableAuthenticationUsingADOPipelineOIDC: enableOidc,
344353
}
345354

346355
backendConfig := BackendConfig{

‎internal/backend/remote-state/azure/backend_test.go

+70-9
Original file line numberDiff line numberDiff line change
@@ -57,7 +57,7 @@ func TestAccBackendAccessKeyBasic(t *testing.T) {
5757
}
5858
defer m.destroyTestResources(ctx)
5959

60-
clearEnv()
60+
clearARMEnv()
6161
b := backend.TestBackendConfig(t, New(), backend.TestWrapConfig(map[string]interface{}{
6262
"storage_account_name": m.names.storageAccountName,
6363
"container_name": m.names.storageContainerName,
@@ -89,7 +89,7 @@ func TestAccBackendSASTokenBasic(t *testing.T) {
8989
t.Fatalf("Error building SAS Token: %+v", err)
9090
}
9191

92-
clearEnv()
92+
clearARMEnv()
9393
b := backend.TestBackendConfig(t, New(), backend.TestWrapConfig(map[string]interface{}{
9494
"storage_account_name": m.names.storageAccountName,
9595
"container_name": m.names.storageContainerName,
@@ -106,6 +106,16 @@ func TestAccBackendGithubOIDCBasic(t *testing.T) {
106106

107107
testAccAzureBackendRunningInGitHubActions(t)
108108

109+
oidcRequestToken := os.Getenv("ACTIONS_ID_TOKEN_REQUEST_TOKEN")
110+
if oidcRequestToken == "" {
111+
t.Fatalf("Missing ACTIONS_ID_TOKEN_REQUEST_TOKEN")
112+
}
113+
114+
oidcRequestURL := os.Getenv("ACTIONS_ID_TOKEN_REQUEST_URL")
115+
if oidcRequestURL == "" {
116+
t.Fatalf("Missing ACTIONS_ID_TOKEN_REQUEST_URL")
117+
}
118+
109119
ctx := newCtx()
110120
m := BuildTestMeta(t, ctx)
111121

@@ -116,14 +126,16 @@ func TestAccBackendGithubOIDCBasic(t *testing.T) {
116126
}
117127
defer m.destroyTestResources(ctx)
118128

119-
clearEnv()
129+
clearARMEnv()
120130
b := backend.TestBackendConfig(t, New(), backend.TestWrapConfig(map[string]interface{}{
121131
"subscription_id": m.subscriptionId,
122132
"resource_group_name": m.names.resourceGroup,
123133
"storage_account_name": m.names.storageAccountName,
124134
"container_name": m.names.storageContainerName,
125135
"key": m.names.storageKeyName,
126136
"use_oidc": true,
137+
"oidc_request_token": oidcRequestToken,
138+
"oidc_request_url": oidcRequestURL,
127139
"tenant_id": m.tenantId,
128140
"client_id": m.clientId,
129141
"environment": m.env.Name,
@@ -132,6 +144,55 @@ func TestAccBackendGithubOIDCBasic(t *testing.T) {
132144
backend.TestBackendStates(t, b)
133145
}
134146

147+
func TestAccBackendADOPipelinesOIDCBasic(t *testing.T) {
148+
t.Parallel()
149+
150+
testAccAzureBackendRunningInADOPipelines(t)
151+
152+
oidcRequestToken := os.Getenv("SYSTEM_ACCESSTOKEN")
153+
if oidcRequestToken == "" {
154+
t.Fatalf("Missing SYSTEM_ACCESSTOKEN")
155+
}
156+
157+
oidcRequestURL := os.Getenv("SYSTEM_OIDCREQUESTURI")
158+
if oidcRequestURL == "" {
159+
t.Fatalf("Missing SYSTEM_OIDCREQUESTURI")
160+
}
161+
162+
adoPipelineServiceConnectionId := os.Getenv("ARM_ADO_PIPELINE_SERVICE_CONNECTION_ID")
163+
if adoPipelineServiceConnectionId == "" {
164+
t.Fatalf("Missing ARM_ADO_PIPELINE_SERVICE_CONNECTION_ID")
165+
}
166+
167+
ctx := newCtx()
168+
m := BuildTestMeta(t, ctx)
169+
170+
err := m.buildTestResources(ctx)
171+
if err != nil {
172+
m.destroyTestResources(ctx)
173+
t.Fatalf("Error creating Test Resources: %q", err)
174+
}
175+
defer m.destroyTestResources(ctx)
176+
177+
clearARMEnv()
178+
b := backend.TestBackendConfig(t, New(), backend.TestWrapConfig(map[string]interface{}{
179+
"subscription_id": m.subscriptionId,
180+
"resource_group_name": m.names.resourceGroup,
181+
"storage_account_name": m.names.storageAccountName,
182+
"container_name": m.names.storageContainerName,
183+
"key": m.names.storageKeyName,
184+
"use_oidc": true,
185+
"oidc_request_token": oidcRequestToken,
186+
"oidc_request_url": oidcRequestURL,
187+
"ado_pipeline_service_connection_id": adoPipelineServiceConnectionId,
188+
"tenant_id": m.tenantId,
189+
"client_id": m.clientId,
190+
"environment": m.env.Name,
191+
})).(*Backend)
192+
193+
backend.TestBackendStates(t, b)
194+
}
195+
135196
func TestAccBackendAzureADAuthBasic(t *testing.T) {
136197
t.Parallel()
137198

@@ -147,7 +208,7 @@ func TestAccBackendAzureADAuthBasic(t *testing.T) {
147208
}
148209
defer m.destroyTestResources(ctx)
149210

150-
clearEnv()
211+
clearARMEnv()
151212
b := backend.TestBackendConfig(t, New(), backend.TestWrapConfig(map[string]interface{}{
152213
"subscription_id": m.subscriptionId,
153214
"resource_group_name": m.names.resourceGroup,
@@ -179,7 +240,7 @@ func TestAccBackendManagedServiceIdentityBasic(t *testing.T) {
179240
}
180241
defer m.destroyTestResources(ctx)
181242

182-
clearEnv()
243+
clearARMEnv()
183244
b := backend.TestBackendConfig(t, New(), backend.TestWrapConfig(map[string]interface{}{
184245
"subscription_id": m.subscriptionId,
185246
"resource_group_name": m.names.resourceGroup,
@@ -215,7 +276,7 @@ func TestAccBackendServicePrincipalClientCertificateBasic(t *testing.T) {
215276
}
216277
defer m.destroyTestResources(ctx)
217278

218-
clearEnv()
279+
clearARMEnv()
219280
b := backend.TestBackendConfig(t, New(), backend.TestWrapConfig(map[string]interface{}{
220281
"subscription_id": m.subscriptionId,
221282
"resource_group_name": m.names.resourceGroup,
@@ -247,7 +308,7 @@ func TestAccBackendServicePrincipalClientSecretBasic(t *testing.T) {
247308
}
248309
defer m.destroyTestResources(ctx)
249310

250-
clearEnv()
311+
clearARMEnv()
251312
b := backend.TestBackendConfig(t, New(), backend.TestWrapConfig(map[string]interface{}{
252313
"subscription_id": m.subscriptionId,
253314
"resource_group_name": m.names.resourceGroup,
@@ -278,7 +339,7 @@ func TestAccBackendAccessKeyLocked(t *testing.T) {
278339
}
279340
defer m.destroyTestResources(ctx)
280341

281-
clearEnv()
342+
clearARMEnv()
282343

283344
b1 := backend.TestBackendConfig(t, New(), backend.TestWrapConfig(map[string]interface{}{
284345
"storage_account_name": m.names.storageAccountName,
@@ -318,7 +379,7 @@ func TestAccBackendServicePrincipalLocked(t *testing.T) {
318379
}
319380
defer m.destroyTestResources(ctx)
320381

321-
clearEnv()
382+
clearARMEnv()
322383

323384
b1 := backend.TestBackendConfig(t, New(), backend.TestWrapConfig(map[string]interface{}{
324385
"subscription_id": m.subscriptionId,

‎internal/backend/remote-state/azure/client_test.go

+6-6
Original file line numberDiff line numberDiff line change
@@ -29,7 +29,7 @@ func TestRemoteClientAccessKeyBasic(t *testing.T) {
2929
}
3030
defer m.destroyTestResources(ctx)
3131

32-
clearEnv()
32+
clearARMEnv()
3333
b := backend.TestBackendConfig(t, New(), backend.TestWrapConfig(map[string]interface{}{
3434
"storage_account_name": m.names.storageAccountName,
3535
"container_name": m.names.storageContainerName,
@@ -61,7 +61,7 @@ func TestRemoteClientManagedServiceIdentityBasic(t *testing.T) {
6161
}
6262
defer m.destroyTestResources(ctx)
6363

64-
clearEnv()
64+
clearARMEnv()
6565
b := backend.TestBackendConfig(t, New(), backend.TestWrapConfig(map[string]interface{}{
6666
"subscription_id": m.subscriptionId,
6767
"resource_group_name": m.names.resourceGroup,
@@ -101,7 +101,7 @@ func TestRemoteClientSasTokenBasic(t *testing.T) {
101101
t.Fatalf("Error building SAS Token: %+v", err)
102102
}
103103

104-
clearEnv()
104+
clearARMEnv()
105105
b := backend.TestBackendConfig(t, New(), backend.TestWrapConfig(map[string]interface{}{
106106
"storage_account_name": m.names.storageAccountName,
107107
"container_name": m.names.storageContainerName,
@@ -133,7 +133,7 @@ func TestRemoteClientServicePrincipalBasic(t *testing.T) {
133133
}
134134
defer m.destroyTestResources(ctx)
135135

136-
clearEnv()
136+
clearARMEnv()
137137
b := backend.TestBackendConfig(t, New(), backend.TestWrapConfig(map[string]interface{}{
138138
"subscription_id": m.subscriptionId,
139139
"resource_group_name": m.names.resourceGroup,
@@ -169,7 +169,7 @@ func TestRemoteClientAccessKeyLocks(t *testing.T) {
169169
}
170170
defer m.destroyTestResources(ctx)
171171

172-
clearEnv()
172+
clearARMEnv()
173173

174174
b1 := backend.TestBackendConfig(t, New(), backend.TestWrapConfig(map[string]interface{}{
175175
"storage_account_name": m.names.storageAccountName,
@@ -215,7 +215,7 @@ func TestRemoteClientServicePrincipalLocks(t *testing.T) {
215215
}
216216
defer m.destroyTestResources(ctx)
217217

218-
clearEnv()
218+
clearARMEnv()
219219

220220
b1 := backend.TestBackendConfig(t, New(), backend.TestWrapConfig(map[string]interface{}{
221221
"subscription_id": m.subscriptionId,

‎internal/backend/remote-state/azure/go.mod

+2-2
Original file line numberDiff line numberDiff line change
@@ -4,8 +4,8 @@ go 1.23.3
44

55
require (
66
github.com/hashicorp/go-azure-helpers v0.71.0
7-
github.com/hashicorp/go-azure-sdk/resource-manager v0.20241212.1154051
8-
github.com/hashicorp/go-azure-sdk/sdk v0.20241212.1154051
7+
github.com/hashicorp/go-azure-sdk/resource-manager v0.20250131.1134653
8+
github.com/hashicorp/go-azure-sdk/sdk v0.20250131.1134653
99
github.com/hashicorp/go-uuid v1.0.3
1010
github.com/hashicorp/terraform v0.0.0-00010101000000-000000000000
1111
github.com/hashicorp/terraform/internal/legacy v0.0.0-00010101000000-000000000000

‎internal/backend/remote-state/azure/go.sum

+4-4
Original file line numberDiff line numberDiff line change
@@ -180,10 +180,10 @@ github.com/hashicorp/errwrap v1.1.0 h1:OxrOeh75EUXMY8TBjag2fzXGZ40LB6IKw45YeGUDY
180180
github.com/hashicorp/errwrap v1.1.0/go.mod h1:YH+1FKiLXxHSkmPseP+kNlulaMuP3n2brvKWEqk/Jc4=
181181
github.com/hashicorp/go-azure-helpers v0.71.0 h1:ra3aIRzg01g6MLKQ+yABcb6WJtrqRUDDgyuPLmyZ9lY=
182182
github.com/hashicorp/go-azure-helpers v0.71.0/go.mod h1:BmbF4JDYXK5sEmFeU5hcn8Br21uElcqLfdQxjatwQKw=
183-
github.com/hashicorp/go-azure-sdk/resource-manager v0.20241212.1154051 h1:jFgd3bzeRViGTzicIn9gDw2O/Gk6WjVJCTTefPNOGPY=
184-
github.com/hashicorp/go-azure-sdk/resource-manager v0.20241212.1154051/go.mod h1:XapOZ9HiCtXz3qb5yNFiCuWbOBj2I3WU1K2jwqgK2zA=
185-
github.com/hashicorp/go-azure-sdk/sdk v0.20241212.1154051 h1:4fCKJPSeLVvwl7ZCqU7MOUKyx/M7kl/J6wlw2O3xn40=
186-
github.com/hashicorp/go-azure-sdk/sdk v0.20241212.1154051/go.mod h1:oI5R0fTbBx3K/sJBK5R/OlEy8ozdQjvctxVU9v3EDkc=
183+
github.com/hashicorp/go-azure-sdk/resource-manager v0.20250131.1134653 h1:KuDCZKWoOByX5MUyFRNWLl4Gy6wpZCwJ7Ez1mbUwouo=
184+
github.com/hashicorp/go-azure-sdk/resource-manager v0.20250131.1134653/go.mod h1:AawbnS/Kkp/IURMJVzmvD+Co2zK91lKFqYYDbenCpGU=
185+
github.com/hashicorp/go-azure-sdk/sdk v0.20250131.1134653 h1:Bd+glHUD1mdal1zn0NgoS4wDFhUB8Qfw61j0nZEnC5A=
186+
github.com/hashicorp/go-azure-sdk/sdk v0.20250131.1134653/go.mod h1:oI5R0fTbBx3K/sJBK5R/OlEy8ozdQjvctxVU9v3EDkc=
187187
github.com/hashicorp/go-cleanhttp v0.5.2 h1:035FKYIWjmULyFRBKPs8TBQoi0x6d9G4xc9neXJWAZQ=
188188
github.com/hashicorp/go-cleanhttp v0.5.2/go.mod h1:kO/YDlP8L1346E6Sodw+PrpBSV4/SoxCXGY6BqNFT48=
189189
github.com/hashicorp/go-cty v1.4.1-0.20200414143053-d3edf31b6320 h1:1/D3zfFHttUKaCaGKZ/dR2roBXv0vKbSCnssIldfQdI=

‎internal/backend/remote-state/azure/helpers_test.go

+31-10
Original file line numberDiff line numberDiff line change
@@ -56,7 +56,16 @@ func testAccAzureBackendRunningInGitHubActions(t *testing.T) {
5656
}
5757
}
5858

59-
// clearEnv cleans up the azure related environment variables.
59+
// these kind of tests can only run when within ADO Pipelines (e.g. OIDC)
60+
func testAccAzureBackendRunningInADOPipelines(t *testing.T) {
61+
testAccAzureBackend(t)
62+
63+
if os.Getenv("TF_RUNNING_IN_ADO_PIPELINES") == "" {
64+
t.Skip("Skipping test since not running in ADO Pipelines")
65+
}
66+
}
67+
68+
// clearARMEnv cleans up the azure related environment variables.
6069
// This is to ensure the configuration only comes from HCL, which avoids
6170
// env vars for test setup interfere the behavior.
6271
//
@@ -65,7 +74,7 @@ func testAccAzureBackendRunningInGitHubActions(t *testing.T) {
6574
// impact can be eliminated given all the tests are implemented in a similar
6675
// pattern that those env vars will be consumed at the very begining. The test
6776
// runner has to ensure to set a **big enough parallelism**.
68-
func clearEnv() {
77+
func clearARMEnv() {
6978
for _, evexp := range os.Environ() {
7079
k, _, ok := strings.Cut(evexp, "=")
7180
if !ok {
@@ -178,19 +187,21 @@ func BuildTestMeta(t *testing.T, ctx context.Context) *TestMeta {
178187
// - MSI: For MSI related tests
179188
// - OIDC: For OIDC related tests
180189
authConfig := &auth.Credentials{
181-
Environment: *env,
182-
TenantID: tenantID,
183-
ClientID: clientID,
184-
ClientSecret: clientSecret,
185-
ClientCertificatePath: os.Getenv("ARM_CLIENT_CERTIFICATE_PATH"),
186-
ClientCertificatePassword: os.Getenv("ARM_CLIENT_CERTIFICATE_PASSWORD"),
187-
GitHubOIDCTokenRequestURL: os.Getenv("ACTIONS_ID_TOKEN_REQUEST_URL"),
188-
GitHubOIDCTokenRequestToken: os.Getenv("ACTIONS_ID_TOKEN_REQUEST_TOKEN"),
190+
Environment: *env,
191+
TenantID: tenantID,
192+
ClientID: clientID,
193+
ClientSecret: clientSecret,
194+
ClientCertificatePath: os.Getenv("ARM_CLIENT_CERTIFICATE_PATH"),
195+
ClientCertificatePassword: os.Getenv("ARM_CLIENT_CERTIFICATE_PASSWORD"),
196+
OIDCTokenRequestURL: getEnvvars("ACTIONS_ID_TOKEN_REQUEST_URL", "SYSTEM_OIDCREQUESTURI"),
197+
OIDCTokenRequestToken: getEnvvars("ACTIONS_ID_TOKEN_REQUEST_TOKEN", "SYSTEM_ACCESSTOKEN"),
198+
ADOPipelineServiceConnectionID: os.Getenv("ARM_ADO_PIPELINE_SERVICE_CONNECTION_ID"),
189199

190200
EnableAuthenticatingUsingClientSecret: true,
191201
EnableAuthenticatingUsingClientCertificate: true,
192202
EnableAuthenticatingUsingManagedIdentity: true,
193203
EnableAuthenticationUsingGitHubOIDC: true,
204+
EnableAuthenticationUsingADOPipelineOIDC: true,
194205
}
195206

196207
resourceManagerAuth, err := auth.NewAuthorizerFromCredentials(ctx, *authConfig, env.ResourceManager)
@@ -325,3 +336,13 @@ func randString(strlen int) string {
325336
}
326337
return string(result)
327338
}
339+
340+
// getEnvvars return the first non-empty env var specified. If none is found, it returns empty string.
341+
func getEnvvars(envvars ...string) string {
342+
for _, envvar := range envvars {
343+
if v := os.Getenv(envvar); v != "" {
344+
return v
345+
}
346+
}
347+
return ""
348+
}

0 commit comments

Comments
 (0)