hashicorp / hashicorp/packer-plugin-azure
Using Managed Identity / Pod Identity, how to specify the Client ID to use
- Dominant language
- Go
- Stars
- 63
- Forks
- 103
- PR merge metrics
- No merged PRs in 30d
Description
_This issue was originally opened by @justinhopper in https://github.com/hashicorp/packer/issues/11242 and has been migrated to this repository. The original issue description is below._
---
#### Overview of the Issue
We have been using Managed Identity assigned to the VM running the Packer Azure ARM build jobs for a few months without problems. However, we have now switched to using AAD Pod Identity for most of our processes, running in Kubernetes, and we've run into a problem with Packer. The issue is that Packer defaults to Managed Identity (MI) if you don't specify client ID or any other auth credentials, and that's great, but using Pod Identity, we get an error that there are multiple identities:
> Build 'azure-arm' errored after 529 milliseconds 26 microseconds: adal: Refresh request failed. Status Code = '400'. Response body: {"error":"invalid_request","error_description":"Multiple user assigned identities exist, please specify the clientId / resourceId of the identity in the token request"}
#### Reproduction Steps
Set up AAD Pod Identity, which means you have a main User Managed Identity for the VM in the k8s cluster, and then an AzureIdentity set up for the pod that uses a different identity (or could be the same identity). Run Packer in that pod and give it no client ID or client secret, so that Packer defaults to using Managed Identity for auth. You should get that same message above, and then have no way to provide Packer with the client ID to use.
### Packer version
`Packer v1.7.2`
### Simplified Packer Buildfile
Our build file is a bit long, but I don't think it's very relevant, I think this issue comes up whenever using Azure ARM builder and MI under AAD Pod Identity.
### Operating system and Environment details
Flatcar Linux on Azure VMs, running Kubernetes 1.20.8
### Log Fragments and crash.log files
> Build 'azure-arm' errored after 529 milliseconds 26 microseconds: adal: Refresh request failed. Status Code = '400'. Response body: {"error":"invalid_request","error_description":"Multiple user assigned identities exist, please specify the clientId / resourceId of the identity in the token request"}
Contributor guide
Research direction
The issue identifies the Azure ARM builder and Managed Identity authentication, but names no repository file or test. Start by reproducing the AAD Pod Identity setup with multiple user-assigned identities and no client ID; done means the builder can select a specified client ID instead of returning the reported multiple-identities error.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- azure, go, kubernetes
- Domain
- authentication, cloud
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 38/100