kitchen-azurerm 2.0.0 → 2.1.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: '0853e2f879329c6b0664e4931574d1ca3a8b8998fc1a5e56424eab212b2f95b1'
-  data.tar.gz: e00246cb4d2f291492df022874e9755fb6dc7745067428dd2f1ac291e57fc32f
+  metadata.gz: f429ccdaffbdba117dea3b15b9e8beff46b7e5d1e0e1b4e23f0ab2565b652685
+  data.tar.gz: cd8ac4c9961e845d121331825a74bc20c85d0317db726f58d5954aedb8b5ffe0
 SHA512:
-  metadata.gz: c8016844395a76393d56fcf31d30b7cb4e14512566c0da7a3a73aeb5fb120f4232d6c1c678feb5ca4d7cd9b159613991b0c759764ff549245e82e5055d8a3ba3
-  data.tar.gz: ec9337480b1b58d0b0a5dc461c99e8d1abbf97e9f0b95dfc8c41b34acf3a4580b0701dfaf0323dd7660164f27602bc9ef912b29cab7cbba5e66a6a99fd7b5cbe
+  metadata.gz: 03a1ed78caa550f245b466c9cfb218dda27d45f50e2b158371e4b14b9f1d45e30d478c277a0ccf437a00855d8dd2f8b8d883d51578b66d750d51c355859d1073
+  data.tar.gz: 181aa2863481530c6d2d78d2d050918dedbc71f51723928eb166dd8ae78d7dd966090f5a112a6202b74d160fba62cf695b29e86335853038672dc342e8577628

data/lib/kitchen/driver/azure/environments.rb

@@ -19,13 +19,45 @@ module Kitchen
         # @!attribute [r] token_audience
         #   @return [String] audience/resource the access token is requested for.
         Environment = Struct.new(:name, :resource_manager_url, :authentication_endpoint, :token_audience) do
-          # The OAuth2 token URL for a tenant in this cloud.
+          # The OAuth2 v1.0 token URL for a tenant in this cloud.
           #
           # @param tenant_id [String]
           # @return [String]
           def token_url(tenant_id)
             "#{authentication_endpoint.chomp("/")}/#{tenant_id}/oauth2/token"
           end
+
+          # The OAuth2 v2.0 token URL for a tenant in this cloud.
+          #
+          # Federated (assertion-based) client credentials are documented
+          # against v2.0, which takes a +scope+ rather than a +resource+.
+          #
+          # @param tenant_id [String]
+          # @return [String]
+          def token_url_v2(tenant_id)
+            "#{authentication_endpoint.chomp("/")}/#{tenant_id}/oauth2/v2.0/token"
+          end
+
+          # The v2.0 scope covering every permission this driver needs.
+          #
+          # @return [String] e.g. +"https://management.azure.com/.default"+
+          def default_scope
+            "#{resource_manager_url.chomp("/")}/.default"
+          end
+
+          # A copy of this cloud pointed at a different Entra ID authority.
+          #
+          # Platforms that issue federated tokens - AKS in particular - set
+          # +AZURE_AUTHORITY_HOST+ to say where those tokens should be
+          # exchanged.
+          #
+          # @param authority [String, nil] the authority URL, or nil to keep this one.
+          # @return [Environment]
+          def with_authority(authority)
+            return self if authority.to_s.empty?
+
+            self.class.new(name, resource_manager_url, authority, token_audience).freeze
+          end
         end
 
         # Every supported cloud, keyed by its downcased name so that lookups are

data/lib/kitchen/driver/azure/token_provider.rb

@@ -120,6 +120,67 @@ module Kitchen
         end
       end
 
+      # Authenticates with a federated token issued by another identity
+      # provider - GitHub Actions, GitLab, Azure DevOps, or a Kubernetes
+      # service account - rather than a stored secret.
+      #
+      # The platform writes a short-lived signed assertion to a file and
+      # rotates it; the file is therefore re-read on every token fetch rather
+      # than cached, or a long +kitchen test+ run would start presenting an
+      # assertion that has since expired.
+      class WorkloadIdentityToken < TokenProvider
+        # @return [String] the client assertion type required by Entra ID.
+        ASSERTION_TYPE = "urn:ietf:params:oauth:client-assertion-type:jwt-bearer".freeze
+
+        # @param environment [Environments::Environment]
+        # @param tenant_id [String]
+        # @param client_id [String]
+        # @param token_file [String] path to the federated token file.
+        def initialize(environment:, tenant_id:, client_id:, token_file:)
+          super(environment:)
+          @tenant_id = tenant_id
+          @client_id = client_id
+          @token_file = token_file
+        end
+
+        # @return [String] path to the federated token file.
+        attr_reader :token_file
+
+        # @return [Array(String, Integer)]
+        # @raise [OperationError] if the assertion file cannot be read.
+        def fetch_token
+          response = Http.request(
+            method: :post,
+            url: environment.token_url_v2(@tenant_id),
+            headers: { "Content-Type" => "application/x-www-form-urlencoded" },
+            body: URI.encode_www_form(
+              grant_type: "client_credentials",
+              client_id: @client_id,
+              client_assertion_type: ASSERTION_TYPE,
+              client_assertion: assertion,
+              scope: environment.default_scope
+            )
+          )
+
+          token_from(response, "the workload identity token endpoint")
+        end
+
+        private
+
+        # The current federated assertion, read fresh each time.
+        #
+        # @return [String]
+        # @raise [OperationError] if the file is missing or unreadable.
+        def assertion
+          File.read(token_file).strip
+        rescue SystemCallError => e
+          raise OperationError.new(
+            "Could not read the federated token file at #{token_file} (#{e.class}). " \
+            "AZURE_FEDERATED_TOKEN_FILE must point at a readable assertion issued by your CI platform."
+          )
+        end
+      end
+
       # Authenticates as a managed identity, via the Instance Metadata Service.
       #
       # This replaces the legacy MSI extension endpoint on port 50342 that the

data/lib/kitchen/driver/azure_credentials.rb

@@ -74,16 +74,24 @@ module Kitchen
 
       # Endpoints for the configured cloud.
       #
+      # +AZURE_AUTHORITY_HOST+ overrides the Entra ID endpoint, which is how
+      # platforms that issue federated tokens point at their own authority.
+      #
       # @return [Azure::Environments::Environment]
       # @raise [Kitchen::UserError] if the cloud name is not recognised.
       def azure_environment
-        @azure_environment ||= Azure::Environments.fetch(environment)
+        @azure_environment ||= Azure::Environments.fetch(environment).with_authority(ENV["AZURE_AUTHORITY_HOST"])
       end
 
       # Selects a token provider based on which credentials resolved.
       #
+      # In precedence order:
+      #
+      # * +AZURE_FEDERATED_TOKEN_FILE+ + +client_id+ + +tenant_id+ - workload
+      #   identity federation, the secretless option for CI.
       # * +client_id+ + +client_secret+ + +tenant_id+ - service principal.
-      # * +client_id+ + +tenant_id+ - user-assigned managed identity.
+      # * +AZURE_USE_MSI+ - managed identity, explicitly.
+      # * +client_id+ without a secret - user-assigned managed identity.
       # * +tenant_id+ only - system-assigned managed identity.
       # * none of the above - falls back to the +az login+ token cache.
       #
@@ -104,11 +112,16 @@ module Kitchen
 
       # @return [Azure::TokenProvider]
       def build_token_provider
-        if client_id && client_secret && tenant_id!
+        if federated_token_file && client_id && tenant_id!
+          debug "Authenticating with workload identity federation (#{federated_token_file})."
+          Azure::WorkloadIdentityToken.new(environment: azure_environment, tenant_id:, client_id:,
+            token_file: federated_token_file)
+        elsif client_id && client_secret && tenant_id!
           Azure::ServicePrincipalToken.new(environment: azure_environment, tenant_id:, client_id:, client_secret:)
-        elsif client_id && tenant_id!
+        elsif use_managed_identity?
           Azure::ManagedIdentityToken.new(environment: azure_environment, client_id:)
         elsif tenant_id!
+          # A tenant with no client credentials means a system-assigned identity.
           Azure::ManagedIdentityToken.new(environment: azure_environment)
         else
           warn("Using tenant id set through `az login`.")
@@ -116,6 +129,27 @@ module Kitchen
         end
       end
 
+      # Whether to authenticate as a managed identity.
+      #
+      # A +client_id+ with no accompanying secret means a user-assigned managed
+      # identity, which is how the Azure SDKs read the same combination.
+      # Crucially this does not require a tenant: the instance metadata service
+      # never sees one, so demanding it only prevented the identity from being
+      # used at all.
+      #
+      # @return [Boolean]
+      def use_managed_identity?
+        return true unless ENV["AZURE_USE_MSI"].to_s.empty?
+
+        !client_id.nil? && client_secret.nil?
+      end
+
+      # @return [String, nil] path to a federated token file, if one is configured.
+      def federated_token_file
+        value = ENV["AZURE_FEDERATED_TOKEN_FILE"]
+        value unless value.to_s.empty?
+      end
+
       # @return [Kitchen::Logger] the shared Test Kitchen logger.
       def logger
         Kitchen.logger

data/lib/kitchen/driver/azurerm_version.rb

@@ -6,6 +6,6 @@ module Kitchen
     # driver and, with it, the whole Azure SDK.
     #
     # @return [String]
-    AZURERM_VERSION = "2.0.0".freeze
+    AZURERM_VERSION = "2.1.0".freeze
   end
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: kitchen-azurerm
 version: !ruby/object:Gem::Version
-  version: 2.0.0
+  version: 2.1.0
 platform: ruby
 authors:
 - Stuart Preston