3
40%
master: 40%

Ran 23 Jul 2026 09:40AM UTC

Files 78

Run time 3s

Badge

Embed ▾

Committed 23 Jul 2026 09:36AM UTC coverage: 50.136%. Remained the same

Job # 29995987296.3

Build Type

push

github

Committed by

web-flow

Commit Message

feat: use workload identity for Holmes investigation pods (ARO-27277) (#4973)

Replace RP-injected pre-acquired tokens with Azure Workload Identity
for Holmes investigation pods. The pod now runs in a dedicated
`holmes-system` namespace with a ServiceAccount linked to a UAMI via
a federated identity credential. DefaultAzureCredential on the pod
acquires tokens automatically.

Changes:
- Remove tokenCredential/AcquireToken from HolmesConfig — pods
  self-authenticate via workload identity
- Add UAMIClientID to HolmesConfig for ServiceAccount annotation
- Move investigation pods to holmes-system namespace with WI label
  and ServiceAccount
- Add ensureHolmesNamespace() with race-safe create-or-update
- Update deploy-holmes-aoai.sh to provision UAMI, federated
  credential, and K8s namespace/ServiceAccount
- Bump HolmesGPT from 0.23.0 to 0.36.0 (includes AZURE_AD_TOKEN_AUTH
  support)

Coverage Stats

3311 of 6604 relevant lines covered (50.14%)

0.55 hits per line

Azure / ARO-RP / 29995987296 / 3
40%
master: 40%

README BADGES
x

Markdown

Textile

RDoc

HTML

Rst

Source Files on job pkg-operator - 29995987296.3

Azure / ARO-RP / 29995987296 / 3 40% master: 40%

README BADGES x

Markdown

Textile

RDoc

HTML

Rst

Source Files on job pkg-operator - 29995987296.3

Azure / ARO-RP / 29995987296 / 3
40%
master: 40%

README BADGES
x