getsops / getsops/sops

azure: try MSI without requiring explicit user opt-in

Open
#704 3 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
Go
Stars
23.1k
Forks
1.1k
Avg merge
1d 11h
Merged PRs (30d)
9

Description

So, I thought this was going to be blocked on Azure/go-autorest#541 as I assumed you were using their GetAuthorizer but I've just noticed that you have your own copy.

Is there a reason we don't go ahead and try Azure MSI as an authentication mechanism automatically?

As of right now, I have to go out of my way to set AZURE_AUTH_MODE when actually using this in real deployment scenarios to get the VMs to pull from KV automatically (any other method requires round-tripping high-value creds into the VM).

Further, it is VERY rare that there is a situation where MSI and CLI creds are available and a supposed user would be surprised to find MSI being used automatically.

This change would allow the existing developer workflow to remain the same. Since MSI is not present on developer machines (or if it is, it's serving the user creds), so you will continue to use CLI creds as normal.

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start by locating the repository's copied GetAuthorizer and the existing AZURE_AUTH_MODE handling. Confirm how MSI and CLI credentials are selected, then verify that MSI is tried automatically in deployment scenarios while the existing developer CLI workflow remains unchanged.

Written by the indexing model from the issue text.

Assessment

Tech stack
azure, go
Domain
authentication, cloud
Issue type
Feature
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
45/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.