hashicorp / hashicorp/packer-plugin-azure

Using Managed Identity / Pod Identity, how to specify the Client ID to use

Open
#144 0 comments 0 reactions 0 assignees View on GitHub
Dominant language
Go
Stars
63
Forks
103
PR merge metrics
No merged PRs in 30d

Description

_This issue was originally opened by @justinhopper in https://github.com/hashicorp/packer/issues/11242 and has been migrated to this repository. The original issue description is below._

---
#### Overview of the Issue

We have been using Managed Identity assigned to the VM running the Packer Azure ARM build jobs for a few months without problems. However, we have now switched to using AAD Pod Identity for most of our processes, running in Kubernetes, and we've run into a problem with Packer. The issue is that Packer defaults to Managed Identity (MI) if you don't specify client ID or any other auth credentials, and that's great, but using Pod Identity, we get an error that there are multiple identities:

> Build 'azure-arm' errored after 529 milliseconds 26 microseconds: adal: Refresh request failed. Status Code = '400'. Response body: {"error":"invalid_request","error_description":"Multiple user assigned identities exist, please specify the clientId / resourceId of the identity in the token request"}

#### Reproduction Steps

Set up AAD Pod Identity, which means you have a main User Managed Identity for the VM in the k8s cluster, and then an AzureIdentity set up for the pod that uses a different identity (or could be the same identity). Run Packer in that pod and give it no client ID or client secret, so that Packer defaults to using Managed Identity for auth. You should get that same message above, and then have no way to provide Packer with the client ID to use.

### Packer version

`Packer v1.7.2`

### Simplified Packer Buildfile

Our build file is a bit long, but I don't think it's very relevant, I think this issue comes up whenever using Azure ARM builder and MI under AAD Pod Identity.

### Operating system and Environment details

Flatcar Linux on Azure VMs, running Kubernetes 1.20.8

### Log Fragments and crash.log files

> Build 'azure-arm' errored after 529 milliseconds 26 microseconds: adal: Refresh request failed. Status Code = '400'. Response body: {"error":"invalid_request","error_description":"Multiple user assigned identities exist, please specify the clientId / resourceId of the identity in the token request"}

Contributor guide

Open the contributing guide

Research direction

The issue identifies the Azure ARM builder and Managed Identity authentication, but names no repository file or test. Start by reproducing the AAD Pod Identity setup with multiple user-assigned identities and no client ID; done means the builder can select a specified client ID instead of returning the reported multiple-identities error.

Written by the indexing model from the issue text.

Assessment

Tech stack
azure, go, kubernetes
Domain
authentication, cloud
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
38/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.