1
40%
master: 40%

Ran 23 Jul 2026 09:40AM UTC

Files 319

Run time 11s

Badge

Embed ▾

Committed 23 Jul 2026 09:36AM UTC coverage: 22.126% (-0.05%) from 22.18%

Job # 29995987296.1

Build Type

push

github

Committed by

web-flow

Commit Message

feat: use workload identity for Holmes investigation pods (ARO-27277) (#4973)

Replace RP-injected pre-acquired tokens with Azure Workload Identity
for Holmes investigation pods. The pod now runs in a dedicated
`holmes-system` namespace with a ServiceAccount linked to a UAMI via
a federated identity credential. DefaultAzureCredential on the pod
acquires tokens automatically.

Changes:
- Remove tokenCredential/AcquireToken from HolmesConfig — pods
  self-authenticate via workload identity
- Add UAMIClientID to HolmesConfig for ServiceAccount annotation
- Move investigation pods to holmes-system namespace with WI label
  and ServiceAccount
- Add ensureHolmesNamespace() with race-safe create-or-update
- Update deploy-holmes-aoai.sh to provision UAMI, federated
  credential, and K8s namespace/ServiceAccount
- Bump HolmesGPT from 0.23.0 to 0.36.0 (includes AZURE_AD_TOKEN_AUTH
  support)

Coverage Stats

4020 of 18169 relevant lines covered (22.13%)

0.26 hits per line

Azure / ARO-RP / 29995987296 / 1
40%
master: 40%

README BADGES
x

Markdown

Textile

RDoc

HTML

Rst

Source Files on job pkg-util - 29995987296.1

Azure / ARO-RP / 29995987296 / 1 40% master: 40%

README BADGES x

Markdown

Textile

RDoc

HTML

Rst

Source Files on job pkg-util - 29995987296.1

Azure / ARO-RP / 29995987296 / 1
40%
master: 40%

README BADGES
x