CM-262: Updates for Azure ambient credentials

[swghosh]

• Update docs/cloud_credentials.md for adding Azure Workload Identity steps.
• Add ambient credentials support for Azure clusters without Workload Identity - allows cluster administrators to inject a specific (explicit) cloud credential secret for Azure clusters, similar to what we already do for AWS non-STS and GCP non-Workload Identity.

[openshift-ci-robot]

@swghosh: This pull request explicitly references no jira issue.

In response to this:

Update docs/cloud_credentials.md for adding Azure Workload Identity steps.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[swghosh]

/cc @snarayan-redhat

[openshift-ci]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: swghosh
Once this PR has been reviewed and has the lgtm label, please assign stlaz for approval. For more information see the Kubernetes Code Review Process.

The full list of commands accepted by this bot can be found here.

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[swghosh]

/cc @xingxingxia @lunarwhite

[xingxingxia]

@swghosh I had thought about non-workload-identy ambient support after testing Azure workload identity cluster and thus I created a "Test"-only Jira CM-262. But later I thought it might be not yet supported by our code, so we move it to To Do. I'm glad to see you also think of it and give support to it. Therefore, let's met retitle:

/retitle CM-262: Updates for Azure ambient credentials

[openshift-ci-robot]

@swghosh: This pull request references CM-262 which is a valid jira issue.

Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the story to target the "4.16.0" version, but no target version was set.

In response to this:

• Update docs/cloud_credentials.md for adding Azure Workload Identity steps.
• Add ambient credentials support for Azure clusters without Workload Identity - allows cluster administrators to inject a specific (explicit) cloud credential secret for Azure clusters, similar to what we already do for AWS non-STS and GCP non-Workload Identity.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[lunarwhite]

/label qe-approved

[openshift-ci-robot]

@swghosh: This pull request references CM-262 which is a valid jira issue.

Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the story to target the "4.16.0" version, but no target version was set.

In response to this:

• Update docs/cloud_credentials.md for adding Azure Workload Identity steps.
• Add ambient credentials support for Azure clusters without Workload Identity - allows cluster administrators to inject a specific (explicit) cloud credential secret for Azure clusters, similar to what we already do for AWS non-STS and GCP non-Workload Identity.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[swghosh]

/hold
for now, I've a security concern regarding exposing the Client Secret into the environment variable directly in the deployment. This would mean for a non-Workload Identity Azure cluster if someone gets access to the Deployment yaml, they'll get access to cloud-credentials secret values and as they're long-lived credentials it might not a good idea to do it this way.

I'll try looking for alternatives to instead use a secret mounted as a file, and still make it work, similar to what we do for AWS and GCP.

[swghosh]

/test fips-image-scan

[openshift-ci]

@swghosh: The following test failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
ci/prow/fips-image-scan	b2d8bb0	link	true	/test fips-image-scan

Full PR test history. Your PR dashboard.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

[openshift-bot]

Issues go stale after 90d of inactivity.

Mark the issue as fresh by commenting /remove-lifecycle stale.
Stale issues rot after an additional 30d of inactivity and eventually close.
Exclude this issue from closing by commenting /lifecycle frozen.

If this issue is safe to close now please do so with /close.

/lifecycle stale

[openshift-bot]

Stale issues rot after 30d of inactivity.

Mark the issue as fresh by commenting /remove-lifecycle rotten.
Rotten issues close after an additional 30d of inactivity.
Exclude this issue from closing by commenting /lifecycle frozen.

If this issue is safe to close now please do so with /close.

/lifecycle rotten
/remove-lifecycle stale