Entra Workload ID Support

[pmsousa]

Hi,

Since the release of Packer Azure plugin v2.0.1 (https://github.com/hashicorp/packer-plugin-azure/releases/tag/v2.0.1), it supports the usage of OIDC to authenticate. Currently, runner-images packer file uses version 1.4.5; if this plugin was updated, we could get rid of client IDs and secrets!
Also, it would be beneficial to support token-based authentication instead of expiring secrets that need periodic renewals.

[ewencodes]

Hi,
This feature needs to be implemented!
Since we use workload identity federation we are not longer able to build images for self-hosted agent pool...

+1

[donk-msft]

To be clear, does this mean the GenerateResourcesAndImage.ps1 script cannot be used in a pipeline using a service connection that uses OIDC?

Any ETA when this will be available?

[ValeruS]

The HashiCorp Packer Azure plugin supports authentication with client_jwt (together with client_id / subscription_id).

Question: Does actions/runner-images support or plan to support passing client_jwt through the templates (for Entra workload identity federation / OIDC from Azure Pipelines)