[oncicaradupopovici]

Summary

Lets Kubernetes workloads authenticate to Azure SQL as the managed identities that AzureDatabase / AzureManagedDatabase already provision, through AKS Workload Identity.

• managedIdentities[].serviceAccounts ({name, namespace?}): for each ServiceAccount a federated identity credential is created on the (tenant-scoped) identity, with subject system:serviceaccount:<namespace>:<name> (namespace defaults to the CR's), audience api://AzureADTokenExchange and issuer AZURE_AKS_OIDC_ISSUER_URL.
  • Credential name <namespace>_<name> (dots in the name become -): _ is illegal in Kubernetes names, so distinct ServiceAccounts can't collide.
  • Credentials on one identity are created sequentially (Azure rejects concurrent writes with 409); the first waits for the identity through identity.Name.
  • Never retained on delete nor imported: they hold no state and are recreated from the spec, and a retained identity must not stay usable from the cluster. After a lost Pulumi state, PULUMI_IMPORT_ALL can't adopt existing credentials: delete them (az identity federated-credential delete) and the next reconcile recreates them (documented in the README).
  • Validated before any of the CR's resources is created: issuer set and an https:// URL, name/namespace present, valid and unique credential names, at most 20 per identity. Like other spec validation errors, a failure stops the reconcile of the whole tenant/domain stack.
  • The ServiceAccount is not created and needs no client-id annotation; workloads select the identity by the exported identityClientId.
• Migration jobs: per-tenant clones now keep the template pod's azure.workload.identity/* labels and annotations (and nothing else), so the webhook injects tokens into migration pods. Templates without such keys produce the same clones as before.
• Chart: AZURE_AKS_OIDC_ISSUER_URL from the optional azure-config key aksOidcIssuerUrl; clusters without the key are unchanged.
• CRDs regenerated with controller-gen v0.22.0 (Makefile installs @latest), hence the version annotation change on every CRD.

Test plan

• go test on all packages
• New unit tests: credential inputs (issuer verbatim incl. trailing slash, subject, name, parent identity, audience), sequential order, not retained, dot sanitizing, namespace/name split collisions, validation cases (incl. non-https issuer), AzureDatabase + AzureManagedDatabase integration, migration clone metadata (fixture from a real template job)
• Mutation checks: breaking ordering / retain / identity dependency / copying all labels makes the tests fail
• helm template: only the new env lines differ; absent when Azure is disabled
• Runtime: federated credential created in QA and a pod authenticating to SQL with it

🤖 Generated with Claude Code