fix: prefer AZURE_FEDERATED_TOKEN_FILE over hardcoded OIDC token path

oidcAuth() defaulted the OIDC token file path to a hardcoded constant
matching the azure-workload-identity webhook's old mount location. The
webhook moved that path in v1.6.0 (a documented breaking change) and
now sets AZURE_FEDERATED_TOKEN_FILE to the current location instead.

Read AZURE_FEDERATED_TOKEN_FILE when no explicit oidcTokenFilePath is
set, falling back to the historical hardcoded default only if the env
var is also unset, so the provider isn't tied to one specific webhook
mount path.

Fixes #1280

Author: gravufo

internal/clients/azure.go

@@ -8,6 +8,7 @@ import (
 	"context"
 	"encoding/json"
 	"net/http"
+	"os"
 	"strings"
 	"sync/atomic"
 
@@ -61,8 +62,15 @@ const (
 	keyStorageUseAzureAD                      = "storage_use_azuread"
 	keyPostgreSQLFlexibleServer               = "postgresql_flexible_server"
 	keyPSQLRestartServerOnConfigurationChange = "restart_server_on_configuration_value_change"
-	// Default OidcTokenFilePath
+	// Default OidcTokenFilePath, used only if AZURE_FEDERATED_TOKEN_FILE is
+	// not set and no explicit oidcTokenFilePath is configured. The azure
+	// workload identity webhook owns this path and has changed it before
+	// (see https://github.com/Azure/azure-workload-identity/releases/tag/v1.6.0),
+	// so AZURE_FEDERATED_TOKEN_FILE is the source of truth whenever available.
 	defaultOidcTokenFilePath = "/var/run/secrets/azure/tokens/azure-identity-token"
+	// envAzureFederatedTokenFile is set by the azure workload identity
+	// webhook to the current projected token path.
+	envAzureFederatedTokenFile = "AZURE_FEDERATED_TOKEN_FILE"
 )
 
 var (
@@ -260,8 +268,14 @@ func oidcAuth(pcSpec *namespacedv1beta1.ProviderConfigSpec, ps *terraform.Setup)
 	if pcSpec.ClientID == nil || len(*pcSpec.ClientID) == 0 {
 		return errors.New(errClientIDNotSet)
 	}
-	// OIDC Token File Path defaults to a projected-volume path mounted in the pod running in the AKS cluster, when workload identity is enabled on the pod.
+	// OIDC Token File Path: an explicit oidcTokenFilePath always wins. Otherwise
+	// prefer AZURE_FEDERATED_TOKEN_FILE, which the azure workload identity webhook
+	// sets to wherever it actually projected the token, falling back to the
+	// historical hardcoded default only if that env var isn't set.
 	ps.Configuration[keyOidcTokenFilePath] = defaultOidcTokenFilePath
+	if tokenFile := os.Getenv(envAzureFederatedTokenFile); tokenFile != "" {
+		ps.Configuration[keyOidcTokenFilePath] = tokenFile
+	}
 	if pcSpec.OidcTokenFilePath != nil {
 		ps.Configuration[keyOidcTokenFilePath] = *pcSpec.OidcTokenFilePath
 	}

internal/clients/azure_test.go

@@ -7,7 +7,10 @@ package clients
 import (
 	"testing"
 
+	"github.com/crossplane/upjet/v2/pkg/terraform"
 	"github.com/google/go-cmp/cmp"
+
+	namespacedv1beta1 "github.com/upbound/provider-azure/v2/apis/namespaced/v1beta1"
 )
 
 func Test_armServiceFromPath(t *testing.T) {
@@ -45,3 +48,57 @@ func Test_armServiceFromPath(t *testing.T) {
 		})
 	}
 }
+
+func Test_oidcAuth_tokenFilePath(t *testing.T) {
+	subID, tenantID, clientID := "sub", "tenant", "client"
+	explicitPath := "/explicit/path/azure-identity-token"
+	envPath := "/var/run/secrets/azure/wi/token/azure-identity-token"
+
+	cases := map[string]struct {
+		oidcTokenFilePath *string
+		envValue          string
+		envSet            bool
+		want              string
+	}{
+		"explicit_path_wins_over_env": {
+			oidcTokenFilePath: &explicitPath,
+			envValue:          envPath,
+			envSet:            true,
+			want:              explicitPath,
+		},
+		"env_used_when_no_explicit_path": {
+			envValue: envPath,
+			envSet:   true,
+			want:     envPath,
+		},
+		"falls_back_to_default_when_env_unset": {
+			want: defaultOidcTokenFilePath,
+		},
+		"falls_back_to_default_when_env_empty": {
+			envValue: "",
+			envSet:   true,
+			want:     defaultOidcTokenFilePath,
+		},
+	}
+	for name, tc := range cases {
+		t.Run(name, func(t *testing.T) {
+			if tc.envSet {
+				t.Setenv(envAzureFederatedTokenFile, tc.envValue)
+			}
+			pcSpec := &namespacedv1beta1.ProviderConfigSpec{
+				SubscriptionID:    &subID,
+				TenantID:          &tenantID,
+				ClientID:          &clientID,
+				OidcTokenFilePath: tc.oidcTokenFilePath,
+			}
+			ps := &terraform.Setup{Configuration: terraform.ProviderConfiguration{}}
+			if err := oidcAuth(pcSpec, ps); err != nil {
+				t.Fatalf("oidcAuth() returned unexpected error: %v", err)
+			}
+			got, _ := ps.Configuration[keyOidcTokenFilePath].(string)
+			if diff := cmp.Diff(tc.want, got); diff != "" {
+				t.Errorf("oidc_token_file_path mismatch (-want +got):\n%s", diff)
+			}
+		})
+	}
+}