feat(azure): support identity binding auth provider

[fseldow]

Description

Adds Kubernetes identity binding as an ACR authentication method, mirroring the azure-acr-credential-provider implementation in cloud-provider-azure.

Instead of federating the projected service account token with Entra (Workload Identity), the token is exchanged directly against the cluster API server's identity binding endpoint — a TLS connection whose SNI host is dialed to a fixed API server IP and validated against the cluster CA — using a client_credentials + jwt-bearer grant. The resulting AAD access token is then exchanged for an ACR refresh token via the existing flow.

Changes

• internal/cloudprovider/azure/identitybinding.go (new): IdentityBindingConfig + identityBindingCredential implementing azcore.TokenCredential. Reads the SA token fresh on each call (rotation-safe), lazily builds/caches a transport that dials APIServerIP while presenting SNIName and trusting the cluster CA (default /etc/kubernetes/certs/ca.crt). Falls back to AZURE_CLIENT_ID, AZURE_TENANT_ID, AZURE_FEDERATED_TOKEN_FILE.
• internal/cloudprovider/azure/tokencredential.go: adds CreateCredentialChainWithIdentityBinding(...). When identity binding is configured it is tried first in the chain, before workload identity and managed identity. CreateCredentialChain is retained as a thin wrapper (no breaking change).
• internal/store/credentialprovider/azure/register.go: exposes an identityBinding config block (sniName, apiServerIP, tokenFilePath, caCertPath) and wires it through.
• Tests (identitybinding_test.go): validation, GetToken success/error paths, transport/CA handling, and chain integration.

Testing

• go build ./..., go vet, and gofmt all clean.
• New unit tests pass; existing config/wiring tests pass.
• The pre-existing GetWithTTL network-dependent tests hang locally without network egress; this behavior is unchanged from main and unrelated to this PR.

[Copilot]

Pull request overview

Note

Copilot couldn't run its full agentic review because it didn't start before the timeout. Make sure your repository has a runner available, or add a copilot-code-review.yml file specifying one with the runs-on attribute. See the docs for more details.

Adds Kubernetes identity binding as a first-class ACR authentication method, integrating it into the existing Azure credential chain and provider configuration.

Changes:

• Introduces an azcore.TokenCredential implementation that exchanges projected SA tokens via the API server identity binding endpoint.
• Extends the Azure credential chain to optionally try identity binding before workload identity and managed identity.
• Wires identity binding configuration through the Azure credential provider registration and adds dedicated unit tests.

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated 5 comments.

File	Description
internal/store/credentialprovider/azure/register.go	Adds identityBinding config block and passes it into the Azure credential chain.
internal/cloudprovider/azure/tokencredential.go	Adds CreateCredentialChainWithIdentityBinding and makes identity binding first in the chain when configured.
internal/cloudprovider/azure/identitybinding.go	New identity binding credential + transport logic (fixed-IP dial + SNI + cluster CA trust).
internal/cloudprovider/azure/identitybinding_test.go	Adds unit coverage for validation, token exchange paths, and transport/CA behavior.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[codecov]

Codecov Report

❌ Patch coverage is 82.42424% with 29 lines in your changes missing coverage. Please review.
✅ Project coverage is 76.80%. Comparing base (07af7a8) to head (151dd5e).

Files with missing lines	Patch %	Lines
internal/cloudprovider/azure/identitybinding.go	83.10%	16 Missing and 9 partials ⚠️
internal/cloudprovider/azure/tokencredential.go	77.77%	1 Missing and 1 partial ⚠️
...nternal/store/credentialprovider/azure/register.go	75.00%	1 Missing and 1 partial ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #2839      +/-   ##
==========================================
+ Coverage   76.58%   76.80%   +0.22%     
==========================================
  Files          89       90       +1     
  Lines        4095     4259     +164     
==========================================
+ Hits         3136     3271     +135     
- Misses        812      830      +18     
- Partials      147      158      +11     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[charleswool]

Also the CI seems to failing

[charleswool]

It seems Identity binding is tried first, but WI and MI are still always appended, saying a runtime identity binding failure will silently falls back to the node's kubelet identity, which typically holds AcrPull via attach-acr, this is going to restore the node-wide access that is supposed to be restricted. I think we should consider not appending the MI source when identityBinding is explicitly set.

[fseldow]

Good catch — this is an important security point. Fixed in 32274e5: when identity binding is configured it is now used exclusively; workload identity and managed identity are no longer appended as fallbacks. A misconfigured/failing identity binding surfaces as an error instead of silently downgrading to the node kubelet identity (which holds AcrPull via attach-acr). See CreateCredentialChainWithIdentityBinding and the new TestCreateCredentialChainWithIdentityBinding exclusive-use test.