CI: workload-identity native

[jackfrancis]

What type of PR is this?

/kind feature

What this PR does / why we need it:

This PR updates E2E CI automation and underlying cluster templates to use workload-identity, with the required Azure infra installed on-demand as part of CI automation.

Which issue(s) this PR fixes (optional, in fixes #<issue number>(, fixes #<issue_number>, ...) format, will close the issue(s) when PR gets merged):
Fixes #

Special notes for your reviewer:

• cherry-pick candidate

TODOs:

• squashed commits
• includes documentation
• adds unit tests

Release note:

CI: workload-identity native

[jackfrancis]

@aramase @nilekhc @sozercan this PR borrows heavily from this azure-workload-identity project-approved script:

https://github.com/Azure/azure-workload-identity/blob/main/scripts/wi-kind-setup.sh

Could you do a high level sanity check of the approach here to automate kind + azwi?

Thank you!

[codecov]

Codecov Report

All modified and coverable lines are covered by tests ✅

Project coverage is 62.04%. Comparing base (2df965a) to head (ceebc0b).

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #4765   +/-   ##
=======================================
  Coverage   62.04%   62.04%           
=======================================
  Files         201      201           
  Lines       16878    16878           
=======================================
  Hits        10472    10472           
  Misses       5623     5623           
  Partials      783      783           

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

[jackfrancis]

/test pull-cluster-api-provider-azure-e2e

[jackfrancis]

/test pull-cluster-api-provider-azure-e2e

[jackfrancis]

/test pull-cluster-api-provider-azure-e2e

[jackfrancis]

/test pull-cluster-api-provider-azure-e2e

[jackfrancis]

/test pull-cluster-api-provider-azure-e2e

[k8s-ci-robot]

LGTM label has been added.

Git tree hash: 6f27826c951ffc7c748f37eebc5f98f63d7af819

[Jont828]

Looks like you got a failure with the e2e-optional test. Seems like the control plane wasn't initialized.

/test pull-cluster-api-provider-azure-e2e-optional

[nojnhuh]

spot test should be fixed by #4910 once that merges.

[nojnhuh]

/test pull-cluster-api-provider-azure-e2e-optional

[jackfrancis]

/hold cancel

[jackfrancis]

/approve

[k8s-ci-robot]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: jackfrancis

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

• OWNERS [jackfrancis]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[nojnhuh]

@jackfrancis Do you intend to squash?

[jackfrancis]

/hold

for squash!

[jackfrancis]

/hold cancel

Thank you @nojnhuh !

[k8s-ci-robot]

@jackfrancis: The following tests failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
pull-cluster-api-provider-azure-windows-containerd-upstream-with-ci-artifacts-serial-slow	ccd17cf	link	false	/test pull-cluster-api-provider-azure-windows-containerd-upstream-with-ci-artifacts-serial-slow
pull-cluster-api-provider-azure-windows-with-ci-artifacts	5e6ede0	link	false	/test pull-cluster-api-provider-azure-windows-with-ci-artifacts

Full PR test history. Your PR dashboard. Please help us cut down on flakes by linking to an open issue when you hit one in your PR.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

[willie-yao]

/retest

[lzhecheng]

@jackfrancis is it required recently to switch to workload-identity for all upstream CI? We are maintaining some own templates with sp.

[jackfrancis]

@lzhecheng those templates will eventually need to be converted when we migrate to prow community k8s infra, as we will no longer be maintaining sp secrets in prow

@jsturtevant and @nawazkh and I are working on a model for that, it will look like this:

https://github.com/kubernetes/test-infra/pull/32837/files

[lzhecheng]

@lzhecheng those templates will eventually need to be converted when we migrate to prow community k8s infra, as we will no longer be maintaining sp secrets in prow

@jsturtevant and @nawazkh and I are working on a model for that, it will look like this:

https://github.com/kubernetes/test-infra/pull/32837/files

I'm curious if it is ok to put tenant id, sub id into a public file. Is it actually a common practice? Or it actually does no harm.

[jackfrancis]

@lzhecheng client id, subscription id, and tenant id are not secret data