Introduce identity based azure-pipelines trigger authentication for scaledObjects / scaledJobs.
Use-Case
With the recent introduction of Azure identity based authentication for Azure DevOps - link , it would be nice if we can leverage identities in the azure-pipelines trigger. As of documentation in 2.11, it seems that only a Personal Access Token (PAT) is supported.
I am using attached startup script for my agent where AZP_CLIENTID, AZP_CLIENTSECRET and AZP_TENANT values are used instead of the PAT token to authenticate with Azure DevOps. The agents are setup as scaled Jobs. The token generated by the identity in this approach is valid for 1 hour only. For this reason, the token is regenerated again in the cleanup() block to accommodate long running jobs. This has been working seamlessly in our setup for the last 2 months. If the same values are available to be passed within the azure-pipelines trigger, it would help remove the dependency on the PAT token altogether.
FYI - Below change has additionally been done in the Dockerfile. Ref - link
ENTRYPOINT [ "./start.sh", "--once" ]
startup.txt
Specification
Introduce identity based azure-pipelines trigger authentication for scaledObjects / scaledJobs.
Use-Case
With the recent introduction of Azure identity based authentication for Azure DevOps - link , it would be nice if we can leverage identities in the azure-pipelines trigger. As of documentation in 2.11, it seems that only a Personal Access Token (PAT) is supported.
I am using attached startup script for my agent where AZP_CLIENTID, AZP_CLIENTSECRET and AZP_TENANT values are used instead of the PAT token to authenticate with Azure DevOps. The agents are setup as scaled Jobs. The token generated by the identity in this approach is valid for 1 hour only. For this reason, the token is regenerated again in the cleanup() block to accommodate long running jobs. This has been working seamlessly in our setup for the last 2 months. If the same values are available to be passed within the azure-pipelines trigger, it would help remove the dependency on the PAT token altogether.
FYI - Below change has additionally been done in the Dockerfile. Ref - link
ENTRYPOINT [ "./start.sh", "--once" ]
startup.txt
Specification