Company
Date Published
Author
Thomas Kappler
Word count
887
Language
English
Hacker News points
None

Summary

Azure OIDC authentication is now supported in the Pulumi Azure Native and Azure Classic providers with the v1.100.0 release, allowing users to authenticate their Pulumi programs with Azure using OpenID Connect (OIDC) without needing secrets such as client secrets or certificates. OIDC, a standardized protocol for federated identity, enables trust between service providers, allowing credentials from one service to be used for another. For Pulumi programs, this involves establishing a trust relationship between Azure and a service like GitHub, followed by configuring the Pulumi program with necessary settings for OIDC token exchange. This process is simplified for GitHub Actions users, as GitHub automatically provides the necessary variables, while other providers require additional configuration settings. The setup involves setting environment variables such as ARM_USE_OIDC and ensuring that the Active Directory App holds federated credentials. The implementation of this authentication method reduces the need for secret management in CI/CD workflows, streamlining access to Azure resources while maintaining security.