Summary
When using use_azure_arc_authentication, token retrieval fails to reach the local Hybrid Instance Metadata Service (HIMDS). The request is sent to http://127.0.0.1/metadata/..., which resolves to port 80, but the Azure Connected Machine agent's HIMDS endpoint listens on 127.0.0.1:40342 by default (Azure docs reference https://learn.microsoft.com/en-us/azure/azure-arc/servers/managed-identity-authentication).
Current behavior
In
azure.rb
:
@azure_arc_instance_metadata_endpoint_ip = '127.0.0.1'.freeze
...
uri = URI("http://#{@azure_arc_instance_metadata_endpoint_ip}/metadata/identity/oauth2/token?...")
No port is set, so URI defaults to 80. On a standard Arc-enrolled machine the connection to 127.0.0.1:80 fails / never hits HIMDS.
Expected behavior
Requests should target the HIMDS default port 40342.
Proposed solution (backward compatible)
Rather than hard-coding a different port, expose the port so operators can override it, while defaulting to the documented Arc default:
Add an endpoint port (e.g. @azure_arc_instance_metadata_endpoint_port = '40342') and include it when building the URI in both get_access_token_azure_arc and the challenge-token request.
Optionally surface it through the api_endpoint_hash in azure_key_vault::secret (e.g. Optional[azure_arc_port] => String) so non-default HIMDS configurations are still supported.
This keeps existing service-principal / IMDS flows untouched and only affects the Arc path.
I'm happy to open a PR if that helps.
Summary
When using use_azure_arc_authentication, token retrieval fails to reach the local Hybrid Instance Metadata Service (HIMDS). The request is sent to http://127.0.0.1/metadata/..., which resolves to port 80, but the Azure Connected Machine agent's HIMDS endpoint listens on 127.0.0.1:40342 by default (Azure docs reference https://learn.microsoft.com/en-us/azure/azure-arc/servers/managed-identity-authentication).
Current behavior
In
azure.rb
:
@azure_arc_instance_metadata_endpoint_ip = '127.0.0.1'.freeze
...
uri = URI("http://#{@azure_arc_instance_metadata_endpoint_ip}/metadata/identity/oauth2/token?...")
No port is set, so URI defaults to 80. On a standard Arc-enrolled machine the connection to 127.0.0.1:80 fails / never hits HIMDS.
Expected behavior
Requests should target the HIMDS default port 40342.
Proposed solution (backward compatible)
Rather than hard-coding a different port, expose the port so operators can override it, while defaulting to the documented Arc default:
Add an endpoint port (e.g. @azure_arc_instance_metadata_endpoint_port = '40342') and include it when building the URI in both get_access_token_azure_arc and the challenge-token request.
Optionally surface it through the api_endpoint_hash in azure_key_vault::secret (e.g. Optional[azure_arc_port] => String) so non-default HIMDS configurations are still supported.
This keeps existing service-principal / IMDS flows untouched and only affects the Arc path.
I'm happy to open a PR if that helps.