Support fetching from protected assets with Azure Storage

Feature Request

Environment

What hardware/cloud provider/hypervisor is being used to run Ignition?

Azure

Desired Feature

Support fetching the Ignition config from an Azure Storage blob that is protected in access by a managed identity. See: https://learn.microsoft.com/en-us/entra/identity/managed-identities-azure-resources/tutorial-linux-managed-identities-vm-access?pivots=identity-linux-mi-vm-access-storage

See:

• https://issues.redhat.com/browse/RFE-1773
• https://issues.redhat.com/browse/COS-3141

Initial implementation in: https://github.com/coreos/ignition/pull/1923

Details that remain to be figured out:

• Does this changes the behavior for existing / unprotected assets?
• Should this be a spec bump? (needed if this changes the current behavior)
• How should we document that support if we want to keep this as is?

The main difference here (compared to AWS S3 support for example) is that this is not using a special URI but regular HTTP URLs, so there is no immediate way of differentiating support / request for that feature.

Tracker for testing: https://github.com/coreos/fedora-coreos-tracker/issues/1871

Other Information

See:

• Documentation tracking issue: https://github.com/coreos/ignition/issues/2008
• In progress documentation: https://github.com/coreos/fedora-coreos-docs/pull/702

Start by reviewing the initial implementation in pull request 1923 and the testing tracker in issue 1871. Resolve whether existing unprotected HTTP assets change, whether a spec bump is needed, and how support should be documented, coordinating with documentation issue 2008 and pull request 702.