spin
spin copied to clipboard
fermyon
Add support for workload identity in the Azure CosmosDB Key/Value impl
This PR adds the ability for the Azure CosmosDB KV store implementation to use ambient authentication (managed identity, workflow identity, azure cli). The PR should not break existing users of the key authentication mechanism; it should only be additive. For more information about the Azure Rust SDK identity flows, check out: https://github.com/Azure/azure-sdk-for-rust/blob/main/sdk/identity/README.md.
Here is the associated infrastructure and sample application to demo this identity flow: https://github.com/devigned/spin-workload-id.
I'm opening this now to start getting feedback. I (or the identity SDK) also likely have a bug related to the authentication scope being passed to Entra (previously Azure Active Directory). I will sort that issue out and notify via the PR.
This work is related to https://github.com/spinkube/spin-operator/issues/252.
Also to note on this PR is that the changes will also allow users to run locally using the Azure CLI to authenticate to Azure CosmosDB. This could be a convenient way of testing / developing with Azure resources without needing to deploy to Azure.
The issue linked (az/rust#1593) is what needs to be resolved & verified prior to completing this PR.
Ok, with https://github.com/Azure/azure-sdk-for-rust/pull/1678 this works as expected. Currently, I am pointing at my fixed branch of the Azure SDK for Rust. Do we want to delay this getting merged until the Azure Rust SDK merges the fix?
The fix to the Azure SDK for Rust has been merged and I've updated this PR to point at that the ref of that change in main. I believe this PR is ready for review.
@devigned I think you have some clippies (and autoformats maybe?) that are unrelated to the changes. I believe these are already picked up in #2569 so you'll probably need to rebase.
@devigned What's the status of this? I believe we're keen for it if you still have bandwidth - is it just the review nits and the lints?
Sorry, I got pulled away. I'll address the feedback and get it updated today. Thank you for your patience.
@itowlson I believe this is ready for review. I'm going to start work on the Key Vault integration to do the same thing.
@devigned You'll need to run make update-cargo-locks to get CI to pass. (This happens because new/changed dependencies in the trigger crate need to feed through into the lockfile for the custom trigger example.)
Integration test failure seems unrelated (it's hitting one of my PRs too).