Enable Azure Workload Identity to authorize against RabbitMQ manageme…

[kratkyzobak]

This PR provides support for Azure AD Workload Identity authorization against RabbitMQ HTTP API in RabbitMQ scaler. This utilizes generic OIDC support introduced in RabbitMQ 3.11

Checklist

• When introducing a new scaler, I agree with the scaling governance policy
• I have verified that my change is according to the deprecations & breaking changes policy
• Tests have been added
• Changelog has been updated and is aligned with our changelog requirements
• A PR is opened to update our Helm chart (repo) (if applicable, ie. when deployment manifests are modified) - not applicable
• A PR is opened to update the documentation on (repo) (if applicable) - Azure AD Workload identity for RabbitMQ scaler keda-docs#1156
• Commits are signed with Developer Certificate of Origin (DCO - learn more)

Fixes #4716

Relates to #

[kratkyzobak]

I'm currently not sure how to provide e2e test for this. I have checked, that workload identity are not checked even in most of azure scalers. To provide e2e test, there would need to be Azure AD app registration in test environment. I can provide with details about configuring this app registration in test tenant if needed.

[zroubalik]

I'm currently not sure how to provide e2e test for this. I have checked, that workload identity are not checked even in most of azure scalers. To provide e2e test, there would need to be Azure AD app registration in test environment. I can provide with details about configuring this app registration in test tenant if needed.

@JorTurFer can help with this one, most likely 😄

[JorTurFer]

I have checked, that workload identity are not checked even in most of azure scalers.

What do you mean? I believe that all the Azure scalers are tested without any pod identity, with AAD pod identity and also with workload identity.
During the e2e startup, workload identity (and others) is deployed.

What would you need for adding the e2e test? I guess that you need an Azure App registration which exposes an api, and granting permissions over that api, am I right?

We have a repository for managing e2e test infrastructure using terraform (the repo is testing-infrastructure), if you open a PR there adding whatever you need, it will be available for e2e tests. We can help you too if you explain us what do you need exactly

[kratkyzobak]

What would you need for adding the e2e test? I guess that you need an Azure App registration which exposes an api, and granting permissions over that api, am I right?

We have a repository for managing e2e test infrastructure using terraform (the repo is testing-infrastructure), if you open a PR there adding whatever you need, it will be available for e2e tests. We can help you too if you explain us what do you need exactly

Yeah, I would need application registration in Azure AD to use as OAuth scope. I will prepare PR into testing-infrastructure with proper azuread_application (would be almost same as rabbit-api resource mentoined here).

Since there is no azuread_* resource within whole testing-infrastructure project, but azuread provider is registered - will SP running github action have right to make app registration, create enterprise app (azuread_service_principal) and assign role of this app to some of managed identity (azuread_app_role_assignment)?

[JorTurFer]

Since there is no azuread_* resource within whole testing-infrastructure project, but azuread provider is registered - will SP running github action have right to make app registration, create enterprise app (azuread_service_principal) and assign role of this app to some of managed identity (azuread_app_role_assignment)?

I think so, but if it couldn't, we can escalate the SP permissions

[kratkyzobak]

I have added e2e tests, but it needs to wait until resolve kedacore/testing-infrastructure#114 (comment). With infrastructure locally created using terraform-infrastructure, added E2E tests are ok.

OT: Are there any logs of previous e2e tests runs available publicly? I cannot find any and I cannot understand how would current rabbitmq tests work. There were missing imports (so tests wont compile), wrong .env file was loaded (probably not problem in Actions runner). Or am I missing something?

[JorTurFer]

/run-e2e rabbit
Update: You can check the progress here

[JorTurFer]

Hi,
You can see the logs clicking in the comment:

[JorTurFer]

Hi @kratkyzobak ,
DCO check is failing and that's because there is some commit not signed. Could you fix it?
https://github.com/kedacore/keda/blob/main/CONTRIBUTING.md#i-didnt-sign-my-commit-now-what

[kratkyzobak]

@JorTurFer fixed. Sorry for that. I used rebase button in Github, but I have different email locally than in Github account.

[zroubalik]

/run-e2e rabbit
Update: You can check the progress here

[zroubalik]

LGTM

Díky!