Azure / ARO-RP / 29995987296

40%

Build Type

push

github

Committed by web-flow

Commit Message

feat: use workload identity for Holmes investigation pods (ARO-27277) (#4973)

Replace RP-injected pre-acquired tokens with Azure Workload Identity
for Holmes investigation pods. The pod now runs in a dedicated
`holmes-system` namespace with a ServiceAccount linked to a UAMI via
a federated identity credential. DefaultAzureCredential on the pod
acquires tokens automatically.

Changes:
- Remove tokenCredential/AcquireToken from HolmesConfig — pods
  self-authenticate via workload identity
- Add UAMIClientID to HolmesConfig for ServiceAccount annotation
- Move investigation pods to holmes-system namespace with WI label
  and ServiceAccount
- Add ensureHolmesNamespace() with race-safe create-or-update
- Update deploy-holmes-aoai.sh to provision UAMI, federated
  credential, and K8s namespace/ServiceAccount
- Bump HolmesGPT from 0.23.0 to 0.36.0 (includes AZURE_AD_TOKEN_AUTH
  support)

Coverage Stats

8 of 37 new or added lines in 3 files covered. (21.62%)

8 existing lines in 5 files now uncovered.

31221 of 78671 relevant lines covered (39.69%)

0.45 hits per line