[Core] PREVIEW: Support managed identity on Azure Arc-enabled Windows server #29187
Conversation
️✔️AzureCLI-FullTest
|
|
Hi @jiasli, |
️✔️AzureCLI-BreakingChangeTest
|
|
Support managed identity on Azure Arc |
microsoft-github-policy-service
bot
added
Account
| def _on_azure_arc(): | ||
| return "IDENTITY_ENDPOINT" in os.environ and "IMDS_ENDPOINT" in os.environ |
There was a problem hiding this comment.
The detection condition is borrowed from MSAL: https://github.com/AzureAD/microsoft-authentication-library-for-python/pull/480/files#diff-24c0727ff4626c6c535d05c13b61fa4b4a47d6fc4496ec0ceadc734191de19cbR367
However, as mentioned in AzureAD/microsoft-authentication-library-for-python#480 (comment), it is fragile.
|
As mentioned in MSAL: https://github.com/AzureAD/microsoft-authentication-library-for-python/pull/480/files#diff-24c0727ff4626c6c535d05c13b61fa4b4a47d6fc4496ec0ceadc734191de19cbR367-R378
|
| # Azure Arc | ||
| if "IDENTITY_ENDPOINT" in os.environ and "IMDS_ENDPOINT" in os.environ: | ||
| logger.debug("Azure Arc detected") | ||
| return True |
There was a problem hiding this comment.
These env vars may not be present on Linux servers, so MSAL introduced a new detection method: AzureAD/microsoft-authentication-library-for-python#731.
After a new MSAL is released, we should switch to _get_arc_endpoint.
There was a problem hiding this comment.
Can we update to use _get_arc_endpoint now since new MSAL has been released for some time
There was a problem hiding this comment.
msal.managed_identity._get_arc_endpoint is a protected method. I have switched to msal.managed_identity.get_managed_identity_source.
jiasli
modified the milestones:
October 2024 (2024-11-11),
November 2024 (2024-11-19)❗ Breaking change release ❗
|
Azure Pipelines successfully started running 3 pipeline(s). |
jiasli
changed the title
Use Azure VM's managed identity in local developmentThis method is inspired by https://msal-python.readthedocs.io/en/latest/#msal.ManagedIdentityClient As Azure CLI still uses request_uri = 'http://localhost:8000/metadata/identity/oauth2/token'Then create a port forwarding using the Now we can run some testing commands locally using the managed identity of the VM, without configuring Azure CLI's dev environment in the VM: |
Related command
az login --identityDescription
az login --identityfor Azure Arc #16573This is only a temporary solution.
If Azure Arc is detected, Azure CLI uses MSAL for managed identity authentication. For other platforms, such as VM and App Service, the existing logic is preserved. These platforms' migration will be done in #25959.