where does the credentials variable come from?

[fernandoroa]

From step 3.
https://github.com/skills/deploy-to-azure/blob/main/.github/steps/3-spinup-environment.md

"Logs into your Azure account with the azure/login action. The AZURE_CREDENTIALS secret you created earlier is used for authentication."

Where is that created earlier?
Step 2. does not have that.
https://github.com/skills/deploy-to-azure/blob/main/.github/steps/2-setup-azure-environment.md

[fernandoroa]

AZURE_CREDENTIALS
can be obtained as described here:

https://learn.microsoft.com/en-us/azure/developer/github/connect-from-azure?tabs=azure-cli%2Clinux

sdk-auth is marked for deprecation
However, as the output of --json-auth and --sdk-auth is the same, and they are synonyms

https://learn.microsoft.com/en-us/cli/azure/ad/sp?view=azure-cli-latest

It is unclear if --json-auth will persist

See: https://learn.microsoft.com/en-us/entra/workload-id/workload-identity-federation

It seems part of the solution is to update:

creds: ${{ secrets.AZURE_CREDENTIALS }}

with

client-id: ${{ secrets.AZURE_CLIENT_ID }}
tenant-id: ${{ secrets.AZURE_TENANT_ID }}
subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID }}

in the .yml

[ian-smithers]

This is actually what I did as per the readme in the action/login repo, but it doesn't work and throws a few new errors regarding adding a security principal. I stopped at that point as it seemed like a security rabbit hole looming before me and isn't integral to my purpose for doing this course. But certainly it seems kind of broken for newcomers.

[fernandoroa]

I think the other half of the answer is to add a federated credential.
And possibly, SP and role, as in: https://fernandoroa.github.io/gh-actions-tuto-fede/page3/

[bronthulke]

I actually found I had to ADD the AZURE_CREDENTIALS secret, and update the other workflows to use those as well instead of using the client ID, tenant ID and subscription Id.

Also, in order to get the right format of JSON for the AZURE_CREDENTIALS secret, I had to add --json-auth to CLI command for creating the service principal.

[fernandoroa]

Related: skills/deploy-to-azure#84