Skip to content

Use workload identity for native Azure tarballs - #162

Merged
johscheuer merged 1 commit into
FoundationDB:mainfrom
tclinkenbeard-oai:dev/tclinkenbeard/joshua-azure-workload-identity
Aug 21, 2026
Merged

johscheuer merged 1 commit into
FoundationDB:mainfrom
tclinkenbeard-oai:dev/tclinkenbeard/joshua-azure-workload-identity

Conversation

@tclinkenbeard-oai

@tclinkenbeard-oai tclinkenbeard-oai commented Jul 16, 2026 •

Copy link
Copy Markdown
Contributor

Summary

  • use Azure workload identity for unsigned native Azure Blob tarball URLs when the federated-token file is present
  • preserve existing public/SAS URL behavior by leaving query-bearing URLs on the current credential path
  • install azure-identity in the Joshua agent image and cover both credential-selection paths

This prevents long-running ensembles from persisting a short-lived SAS and losing replacement agents after expiry.

Validation

  • focused native Azure tests: 3 passed
  • verified a live Joshua agent has the three workload-identity variables and can perform an authenticated one-byte read of the private correctness artifact (206)

@johscheuer johscheuer left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM 👍 Thanks!

@johscheuer
johscheuer merged commit 21828e2 into FoundationDB:main Aug 21, 2026
1 check passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants