Acquire token for IMDS SAMI

[4gust]

Add ManagedIdentity Class and acquireToken Function for SystemAssigned Identity

Overview

This PR introduces a new ManagedIdentity class in the Go codebase, specifically designed to handle operations related to managed identities in Azure. The primary feature added in this PR is the acquireToken function within the ManagedIdentity class, which currently supports only SystemAssigned managed identities.

Changes

• ManagedIdentity:

  • Created a new class named ManagedIdentity to encapsulate managed identity operations.
  • The class is intended to support different types of managed identities (SystemAssigned, UserAssigned) in the future, but for now, it only supports SystemAssigned identities.

• acquireToken Function:

  • Implemented an acquireToken function in the ManagedIdentity class.
  • This function is responsible for acquiring an access token for the SystemAssigned managed identity.
  • The function makes a call to the Azure Instance Metadata Service (IMDS) endpoint to fetch the token.

Implementation Details

• SystemAssigned Identity:

  • The acquireToken function currently assumes that the managed identity is SystemAssigned.
  • It retrieves the access token using the endpoint: http://127.0.0.1:40342/metadata/identity/oauth2/token.

• Error Handling:

  • The function includes basic error handling to manage cases where the token cannot be acquired.
  • If the HTTP request to the IMDS endpoint fails, the function returns an error with appropriate context.

Testing

• Unit Tests:
  • Added unit tests for the acquireToken function to ensure it behaves as expected when fetching tokens for a SystemAssigned identity.
  • Tests include scenarios for successful token acquisition and error cases (e.g., network failure).

Checklist

• Code compiles successfully.
• Unit tests added and pass locally. (more work to be done here)

Notes

• This is the initial implementation of the ManagedIdentity class with limited functionality. Please review and suggest improvements, especially concerning the design for future extensibility.

[bgavrilMS]

Looks good, some more tests are needed I think, particularly for getting error responses from IMDS (like 400 error with details about the error)

[AndyOHart]

Looks good to me

[chlowell]

Not a blocker but this else is still unnecessary. What you have is like

if err != nil {
    os.Exit(1)
} else {
    // this block never executes when err != nil, so you don't
    // need the else to prevent it executing in that case
}

[chlowell]

Why delete the callback you had here? Don't you want to validate the request? Now you have this test doing

url := testCase.endpoint
// ... nothing modifies the value of url ...
if !strings.HasPrefix(url, testCase.endpoint) {
	t.Fatal("this line will never execute")
}

and you're really only testing that the client can unmarshal the response. That's important, but so is the client's request

[4gust]

Updated to check alot more values in the request.

[chlowell]

I suggested merging this into another test, not simply deleting it; the coverage is important

[4gust]

I added that test to Test_SystemAssigned_Returns_Token_Success

[chlowell]

👀 do you intend to make this change?

[4gust]

I Was testing the api on the VM so, to get these changes there pushed this, now reverted.

[sonarqubecloud]

Quality Gate failed

Failed conditions
1 Security Hotspot

See analysis details on SonarCloud