Azure China Workload Identity unsupported (issuer mismatch) #5591
Description
- Trying to upgrade ESO to 1.0.0
- Created a Clustersecretstore for China Env with workload identity as per the CRD to Azure Key Vaults with Service account as reference
apiVersion: external-secrets.io/v1
kind: ClusterSecretStore
metadata:
name: kv-abc-keyvault
spec:
controller: ""
provider:
azurekv:
authType: WorkloadIdentity
environmentType: ChinaCloud
vaultUrl: https://kv-abc-keyvault.vault.azure.cn
serviceAccountRef:
name: example
namespace: test
apiVersion: v1
kind: ServiceAccount
metadata:
name: example
namespace: test
annotations:
azure.workload.identity/client-id: xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
azure.workload.identity/tenant-id: xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
labels:
azure.workload.identity/use: "true"
- But clustersecret store is showing error (The tenant ID is correct. I have confirmed)
unable to resolve an endpoint: ResolveEndpoints(): TenantDiscoveryResponse: issuer from OIDC discovery 'https://login.partner.microsoftonline.cn/xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx/v2.0' does not match authority 'https://login.chinacloudapi.cn/xxxxxxxxxxxxxxxxxxxxxxxxxxxxx/' or a known pattern
-
AKS in Azure China uses the OIDC issuer
https://login.partner.microsoftonline.cn/<tenant>/v2.0, but ESO ChinaCloud environment hardcodes the Azure AD authorityhttps://login.chinacloudapi.cn. -
CRD does not expose fields like:
aadEndpointservicePrincipalEndpointresourceManagerEndpointSo it is currently impossible to use Workload Identity in Azure China. -
Is it possible to fix this?
-
Or possible to add support for overriding AAD endpoints for Azure China, or update the ChinaCloud configuration to match the AKS Workload Identity issuer (login.partner.microsoftonline.cn)