hashicorp / hashicorp/packer-plugin-azure
Feature Request : Azure - Support managed identity in non-VM environments
- Dominant language
- Go
- Stars
- 63
- Forks
- 103
- PR merge metrics
- No merged PRs in 30d
Description
_This issue was originally opened by @aswinrajamannar as hashicorp/packer#7469. It was migrated here as a result of the [Packer plugin split](https://github.com/hashicorp/packer/issues/8610#issuecomment-770034737). The original body of the issue is below._
Today Packer supports specifying certificate-based bearer JWT assertion through client_jwt parameter, or automatically getting it from the IMDS endpoint available for IaaS VMs. But in scenarios like App Service Web Jobs, neither of these are an option.
In App Service for instance, there is a REST endpoint to get the token which is different from the IMDS endpoint.
https://docs.microsoft.com/en-us/azure/app-service/overview-managed-identity#using-the-rest-protocol
Ability to either specify the exact access token to use, or to use the REST protocol specified above would help to run Packer in these environments.
Contributor guide
Research direction
Start by reviewing the existing Azure authentication flow that supports client_jwt and the VM IMDS endpoint, then compare it with Azure App Service's REST managed-identity protocol described in the issue. Determine whether the completed change should accept an explicit access token, support the REST endpoint, or both, and verify that Packer can authenticate in non-VM environments.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- azure, go
- Domain
- authentication, cloud
- Issue type
- Feature
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 45/100