Skip to content

UID2-8294: Add Azure OIDC login support #267

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
sophia-chen-ttd merged 5 commits into from
Nov 12, 2026
Merged

UID2-8294: Add Azure OIDC login support #267

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
e7bed0e
UID2-8294: Add Azure OIDC login support
sophia-chen-ttd Nov 12, 2026
385448a
UID2-8294: Centralize Azure OIDC identifiers
sophia-chen-ttd Nov 12, 2026
ed19e95
UID2-8294: Remove legacy Azure credentials
sophia-chen-ttd Nov 12, 2026
8ebb484
UID2-8294: Configure Azure OIDC from caller variables
sophia-chen-ttd Nov 12, 2026
86c8c7c
UID2-8294: Use environment subject for Azure E2E
sophia-chen-ttd Nov 12, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
34 changes: 29 additions & 5 deletions .github/workflows/shared-run-e2e-tests.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -73,6 +73,19 @@ on:
description: The AWS PCR0
type: string

azure_client_id:
description: The Azure application client ID for OIDC login
type: string
azure_tenant_id:
description: The Azure tenant ID for OIDC login
type: string
azure_subscription_id:
description: The Azure subscription ID for OIDC login
type: string
azure_environment:
description: The GitHub environment used for Azure OIDC login
type: string

env:
REGISTRY: ghcr.io

Expand Down Expand Up @@ -106,6 +119,7 @@ jobs:
name: E2E Test
# The pinned azure-cli is not in Microsoft's apt repo for Ubuntu 26.04 (ubuntu-latest).
runs-on: ${{ inputs.operator_type == 'aks' && 'ubuntu-24.04' || 'ubuntu-latest' }}
environment: ${{ inputs.azure_environment }}
permissions:
contents: write
packages: read
Expand Down Expand Up @@ -220,7 +234,9 @@ jobs:
if: ${{ inputs.operator_type == 'aks' }}
uses: IABTechLab/uid2-shared-actions/actions/start_aks_cluster@v3
with:
azure_credentials: ${{ secrets.AZURE_CREDENTIALS }}
azure_client_id: ${{ inputs.azure_client_id }}
azure_tenant_id: ${{ inputs.azure_tenant_id }}
azure_subscription_id: ${{ inputs.azure_subscription_id }}
run_id: ${{ github.run_id }}

- name: Get AKS operator key
Expand Down Expand Up @@ -283,7 +299,9 @@ jobs:
bore_url_optout: ${{ steps.bore.outputs.bore_url_optout }}
template_file: ${{ steps.prepare_azure_metadata.outputs.template_file }}
parameters_file: ${{ steps.prepare_azure_metadata.outputs.parameters_file }}
azure_credentials: ${{ secrets.AZURE_CREDENTIALS }}
azure_client_id: ${{ inputs.azure_client_id }}
azure_tenant_id: ${{ inputs.azure_tenant_id }}
azure_subscription_id: ${{ inputs.azure_subscription_id }}
target_environment: ${{ inputs.target_environment }}

- name: Start AWS private operator
Expand All @@ -306,7 +324,9 @@ jobs:
uses: IABTechLab/uid2-shared-actions/actions/start_aks_private_operator@v3
with:
template_file: ${{ steps.prepare_aks_metadata.outputs.template_file }}
azure_credentials: ${{ secrets.AZURE_CREDENTIALS }}
azure_client_id: ${{ inputs.azure_client_id }}
azure_tenant_id: ${{ inputs.azure_tenant_id }}
azure_subscription_id: ${{ inputs.azure_subscription_id }}
run_id: ${{ github.run_id }}

- name: Decide E2E test environment variables
Expand Down Expand Up @@ -406,7 +426,9 @@ jobs:
if: ${{ inputs.operator_type == 'azure' }}
uses: IABTechLab/uid2-shared-actions/actions/stop_azure_private_operator@v3
with:
azure_credentials: ${{ secrets.AZURE_CREDENTIALS }}
azure_client_id: ${{ inputs.azure_client_id }}
azure_tenant_id: ${{ inputs.azure_tenant_id }}
azure_subscription_id: ${{ inputs.azure_subscription_id }}
azure_container_group_name: ${{ needs.e2e-test.outputs.azure_container_group_name }}

- name: Stop AWS private operator
Expand All @@ -426,5 +448,7 @@ jobs:
if: ${{ inputs.operator_type == 'aks' }}
uses: IABTechLab/uid2-shared-actions/actions/stop_aks_private_operator@v3
with:
azure_credentials: ${{ secrets.AZURE_CREDENTIALS }}
azure_client_id: ${{ inputs.azure_client_id }}
azure_tenant_id: ${{ inputs.azure_tenant_id }}
azure_subscription_id: ${{ inputs.azure_subscription_id }}
run_id: ${{ github.run_id }}
16 changes: 12 additions & 4 deletions actions/start_aks_cluster/action.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,8 +2,14 @@ name: Start AKS Cluster
description: Creates the AKS cluster and infrastructure

inputs:
azure_credentials:
description: The Azure credentials
azure_client_id:
description: The Azure application client ID for OIDC login
required: true
azure_tenant_id:
description: The Azure tenant ID for OIDC login
required: true
azure_subscription_id:
description: The Azure subscription ID for OIDC login
required: true
run_id:
description: Unique run identifier for resource naming
Expand All @@ -13,10 +19,12 @@ runs:
using: "composite"

steps:
- name: Log in to Azure
- name: Log in to Azure with OIDC
uses: azure/login@532459ea530d8321f2fb9bb10d1e0bcf23869a43 # v3.0.0
with:
creds: ${{ inputs.azure_credentials }}
client-id: ${{ inputs.azure_client_id }}
tenant-id: ${{ inputs.azure_tenant_id }}
subscription-id: ${{ inputs.azure_subscription_id }}
enable-AzPSSession: true

- name: Start AKS cluster
Expand Down
16 changes: 12 additions & 4 deletions actions/start_aks_private_operator/action.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,8 +5,14 @@ inputs:
template_file:
description: The template file
required: true
azure_credentials:
description: The Azure credentials
azure_client_id:
description: The Azure application client ID for OIDC login
required: true
azure_tenant_id:
description: The Azure tenant ID for OIDC login
required: true
azure_subscription_id:
description: The Azure subscription ID for OIDC login
required: true
run_id:
description: Unique run identifier for resource naming
Expand All @@ -21,10 +27,12 @@ runs:
using: "composite"

steps:
- name: Log in to Azure
- name: Log in to Azure with OIDC
uses: azure/login@532459ea530d8321f2fb9bb10d1e0bcf23869a43 # v3.0.0
with:
creds: ${{ inputs.azure_credentials }}
client-id: ${{ inputs.azure_client_id }}
tenant-id: ${{ inputs.azure_tenant_id }}
subscription-id: ${{ inputs.azure_subscription_id }}
enable-AzPSSession: true

- name: Start AKS private operator
Expand Down
16 changes: 12 additions & 4 deletions actions/start_azure_private_operator/action.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -14,8 +14,14 @@ inputs:
parameters_file:
description: The parameters file
required: true
azure_credentials:
description: The Azure credentials
azure_client_id:
description: The Azure application client ID for OIDC login
required: true
azure_tenant_id:
description: The Azure tenant ID for OIDC login
required: true
azure_subscription_id:
description: The Azure subscription ID for OIDC login
required: true
target_environment:
description: The target environment [mock, integ, prod]
Expand All @@ -33,10 +39,12 @@ runs:
using: "composite"

steps:
- name: Log in to Azure
- name: Log in to Azure with OIDC
uses: azure/login@532459ea530d8321f2fb9bb10d1e0bcf23869a43 # v3.0.0
with:
creds: ${{ inputs.azure_credentials }}
client-id: ${{ inputs.azure_client_id }}
tenant-id: ${{ inputs.azure_tenant_id }}
subscription-id: ${{ inputs.azure_subscription_id }}
enable-AzPSSession: true

- name: Start Azure private operator
Expand Down
16 changes: 12 additions & 4 deletions actions/stop_aks_private_operator/action.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,8 +2,14 @@ name: Stop AKS Private Operator
description: Spins down an AKS private operator

inputs:
azure_credentials:
description: The Azure credentials
azure_client_id:
description: The Azure application client ID for OIDC login
required: true
azure_tenant_id:
description: The Azure tenant ID for OIDC login
required: true
azure_subscription_id:
description: The Azure subscription ID for OIDC login
required: true
run_id:
description: Unique run identifier for resource naming
Expand All @@ -13,10 +19,12 @@ runs:
using: "composite"

steps:
- name: Log in to Azure
- name: Log in to Azure with OIDC
uses: azure/login@532459ea530d8321f2fb9bb10d1e0bcf23869a43 # v3.0.0
with:
creds: ${{ inputs.azure_credentials }}
client-id: ${{ inputs.azure_client_id }}
tenant-id: ${{ inputs.azure_tenant_id }}
subscription-id: ${{ inputs.azure_subscription_id }}
enable-AzPSSession: true

- name: Stop AKS private operator
Expand Down
16 changes: 12 additions & 4 deletions actions/stop_azure_private_operator/action.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,8 +2,14 @@ name: Stop Azure Private Operator
description: Spins down an Azure private operator

inputs:
azure_credentials:
description: The Azure credentials
azure_client_id:
description: The Azure application client ID for OIDC login
required: true
azure_tenant_id:
description: The Azure tenant ID for OIDC login
required: true
azure_subscription_id:
description: The Azure subscription ID for OIDC login
required: true
azure_container_group_name:
description: The Azure instance name
Expand All @@ -13,10 +19,12 @@ runs:
using: "composite"

steps:
- name: Log in to Azure
- name: Log in to Azure with OIDC
uses: azure/login@532459ea530d8321f2fb9bb10d1e0bcf23869a43 # v3.0.0
with:
creds: ${{ inputs.azure_credentials }}
client-id: ${{ inputs.azure_client_id }}
tenant-id: ${{ inputs.azure_tenant_id }}
subscription-id: ${{ inputs.azure_subscription_id }}
enable-AzPSSession: true

- name: Stop Azure private operator
Expand Down
Loading