Update Taskfile to use az cli token rather than SP
Update az login step to use an interactive login, rather than an SP.
Interactive login is good for 12 hours.
Remove SP-based kind cluster helpers and replace usages with
workload-identity based.
Refactor make-mi-fic.sh to Python. This is required to manage the
more limited permissions that an interactive token has with repsect
to calling 'az role assignment list'.
HTTP Recording tests now use CLI or ServicePrincipal credentials
CLI credentials are preferred over ServicePrincipal.
Add unit tests with mocked azidentity calls
This replaces actual live testing of the various
authentication modes. We trust that, if we call the azidentity SDK with
the correct parameters, it does the correct thing.
Fix issue with credential format documentation
We documented the AUTH_MODE: "workloadidentity" for workload identity,
but in actuality the code doesn't require this be set for WI on any
secret but the global secret.
Remove use of MULTITENANT secret
Now using a dynamically created UserAssignedIdentity instead of a
hardcoded static multitenant secret.
There are two advantages here:
Less setup to run a test on a new subscription because fewer inputs
to the CI job.
No static secrets that can possibly be leaked or compromised.
Use MSI for CI instead of service principal
Updated cipool BICEP to provision a managed identity and give it the
required roles.
Updated Taskfile to support MSI-based az login when running in the
context of a GitHub action.
Removed all reference to AZURE_CLIENT_ID and AZURE_CLIENT_SECRET from
GitHub workflows.
Update documentation to be more clear about authentication mode
Be explicit about which mode we're using in the various installation
instructions, and provide links to the detailed authentication
documentation so that users are more easily exposed to other
authentication options (formats and scopes).
Closes #3930
If applicable: