Support UAMI/Workload Identity for running self-hosted github runners on AKS

[sibj0801]

Goal

I would like to use workload identity for authenticating towards Azure and my container registry. I am using workload identities for everything else.

Context

We are using ARC (https://github.com/actions/actions-runner-controller) which is the officially endorsed Microsoft/Github way to run actions on K8S hardware. We are running on an AKS cluster with VMSS and the action still fails.

You state that it is supported on Azure VM's only (https://github.com/Azure/login/#login-with-user-assigned-managed-identity), but it doesn't seem to include scale sets?

Docker is using your action in their documentation, so it was a surprise to us that their solution didn't work: https://github.com/docker/login-action#openid-connect-oidc

This seems to be somewhat of an oversight, ARC is an old project and it seems strange that the official Azure action wouldn't support it.

Similar issues

#293

[MaddyMicrosoft]

Hey Solmyr123 (@sibj0801) thanks for raising an issue, it seems like there is few things to untangle here:

supported on Azure VMs only, but not scale sets?
That path uses auth-type: IDENTITY, which is IMDS-based. IMDS works on VMSS too, so it isn't a VM-vs-scale-set limitation. The real point: IDENTITY reads a host-assigned identity via IMDS, a different mechanism from AKS Workload Identity (a token projected into the pod at AZURE_FEDERATED_TOKEN_FILE), so it isn't the right fit here.

On the docker example. That ACR recipe seems to use GitHub Actions OIDC, not workload identity. docker/login-action documents workload identity only for Google Cloud; for Azure it offers only service-principal or GitHub OIDC. The OIDC recipe can work on ARC runners, but only with a repo-trusting federated credential.

To reuse your AKS workload identity (the projected token), the action doesn't read it yet (tracked in #293). Have you tried:

az login --federated-token "$(cat $AZURE_FEDERATED_TOKEN_FILE)" --service-principal -u $AZURE_CLIENT_ID -t $AZURE_TENANT_ID

Could you share the exact error and your azure/login config so we can point you at the right path?