Unable to use Azure Workload Identity, AZURE_CLIENT_ID and AZURE_TENANT_ID are overritten by chart.

[maciej-umanski]

Describe the bug

While deploying EDC using "tractusx-connector-azure-vault" on Azure utilizing workload identity, charts are overriding the values that are attached automatically by Azure webhook.

To Reproduce

Try to deploy EDC using tractusx-connector-azure-vault chart.

Expected behavior

Variables should be optional to allow for webhook to be attached properly.

Screenshots/Error Messages

Cause:

Actual behaviour:

Expected behaviour:

Context Information

n/a

Possible Implementation

Make variables "AZURE_CLIENT_ID" and "AZURE_TENANT_ID" optional.

[paullatzelsperger]

I took a brief look at the PR, and it looks OK, but before we move forward, could you pls explain a bit more what the use case is? I haven't fully understood it. Is this because some Azure deployment mechanism writes the same env vars (AZURE_CLIENT_ID and AZURE_TENANT_ID)? Could you maybe point me to some documentation explaining this?

[maciej-umanski]

Hello, sure :)

Generally EDC updated the Azure libraries that allows Azure Federated Credential authorization with use of managed identities. This is automatic mechanism for Azure to authorize without any secrets and is fully managed by Kubernetes webhook.
When you annotate the pod with label: azure.workload.identity/use: "true" the variables are automatically set to pod that allows Azure libraries (example for Java) to authorize with these credentials.

https://learn.microsoft.com/en-us/azure/aks/workload-identity-overview
https://learn.microsoft.com/en-us/azure/aks/learn/tutorial-kubernetes-workload-identity

The problem there is, that tractus-x with update to 0.7.0 changed Azure authentication variables from EDC_VAULT_CLIENTID, EDC_VAULT_TENANTID to AZURE_CLIENT_ID and AZURE_TENANT_ID (source, point 6). Charts are overriding the variables that are created automatically via workload identity webhook.

[paullatzelsperger]

ok got it. Just for the sake of completeness, this example shows the goings-on best I think.