Repository navigation
Use Azure Pipelines Credential for authentication in ImageBuilder - #1712
Merged
Merged
Conversation
mthalman
reviewed
May 27, 2025
mthalman
approved these changes
May 28, 2025
lbussell
enabled auto-merge (squash)
May 28, 2025 16:24
lbussell
added a commit
that referenced
this pull request
Dec 8, 2025
Previously, AzureTokenCredentialProvider would use `WorkloadIdentityCredential` during builds. In order to work around Workload Identity Credential lifetimes, we implemented a StaticTokenCredential that immediately fetched the requested token and cached it forever (added with #1321). WIF token lifetimes are documented [here](https://learn.microsoft.com/en-us/azure/devops/pipelines/release/troubleshoot-workload-identity?view=azure-devops#error-messages). Since #1712, we use `AzurePipelinesCredential` instead. `AzurePipelinesCredential` handles all of the lifetime/expiration concerns. We can use it directly and allow the Azure SDK to handle caching and automatic refresh when tokens are close to expiring. I have not found any documented restrictions on its lifetime. The System.AccessToken and the resulting AzurePipelinesCredential *should* be valid for the entire length of the pipeline job and no longer. I have built a test version of ImageBuilder with this change and validated it against our longest running build job, here: https://dev.azure.com/dnceng/internal/_build/results?buildId=2854918&view=logs&j=5b10b89b-008d-5f76-ef8b-7fc595d90c00&t=a505c4d8-3f6e-56eb-f81a-e4be2494dd9a It happily spends over 3 hours building images and then has no trouble pushing them.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This is part 1/2 of #1711.
Replaces all usage of
WorkloadIdentityCredentialwithAzurePipelinesCredential.AzurePipelinesCredentialuses service connection information in combination with the pipeline System.AccessToken to authenticate.AzurePipelinesCredentialis simpler thanWorkloadIdentityCredential, but it didn't exist when we initially moved away from service principal/token authentication. Now, we need to adopt this in order to enable using multiple service connections in one ImageBuilder command.I have validated that all of this works in a container, in an Azure pipeline. I am preparing the pipeline template changes for this change separately.
Part 2/2 will be to add a second service connection argument to the build command, so that we can authenticate to an internal storage account for internal builds.