Class: Kitchen::Driver::Azure::WorkloadIdentityToken

Inherits:
TokenProvider
  • Object
show all
Defined in:
lib/kitchen/driver/azure/token_provider.rb

Overview

Authenticates with a federated token issued by another identity provider - GitHub Actions, GitLab, Azure DevOps, or a Kubernetes service account - rather than a stored secret.

The platform writes a short-lived signed assertion to a file and rotates it; the file is therefore re-read on every token fetch rather than cached, or a long kitchen test run would start presenting an assertion that has since expired.

Constant Summary collapse

ASSERTION_TYPE =

Returns the client assertion type required by Entra ID.

Returns:

  • (String) —

    the client assertion type required by Entra ID.

"urn:ietf:params:oauth:client-assertion-type:jwt-bearer".freeze

Constants inherited from TokenProvider

TokenProvider::EXPIRY_MARGIN

Instance Attribute Summary collapse

Attributes inherited from TokenProvider

#environment

Instance Method Summary collapse

Methods inherited from TokenProvider

#access_token, #authorization_header

Constructor Details

#initialize(environment:, tenant_id:, client_id:, token_file:) ⇒ WorkloadIdentityToken

Returns a new instance of WorkloadIdentityToken.

Parameters:

  • environment (Environments::Environment)
  • tenant_id (String)
  • client_id (String)
  • token_file (String) —

    path to the federated token file.



139
140
141
142
143
144
 
# File 'lib/kitchen/driver/azure/token_provider.rb', line 139

def initialize(environment:, tenant_id:, client_id:, token_file:)
  super(environment:)
  @tenant_id = tenant_id
  @client_id = client_id
  @token_file = token_file
end

Instance Attribute Details

#token_file ⇒ String (readonly)

Returns path to the federated token file.

Returns:

  • (String) —

    path to the federated token file.



147
148
149
 
# File 'lib/kitchen/driver/azure/token_provider.rb', line 147

def token_file
  @token_file
end

Instance Method Details

#fetch_token ⇒ Array(String, Integer)

Returns:

  • (Array(String, Integer))

Raises:



151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
 
# File 'lib/kitchen/driver/azure/token_provider.rb', line 151

def fetch_token
  response = Http.request(
    method: :post,
    url: environment.token_url_v2(@tenant_id),
    headers: { "Content-Type" => "application/x-www-form-urlencoded" },
    body: URI.encode_www_form(
      grant_type: "client_credentials",
      client_id: @client_id,
      client_assertion_type: ASSERTION_TYPE,
      client_assertion: assertion,
      scope: environment.default_scope
    )
  )

  token_from(response, "the workload identity token endpoint")
end