Azure Blob Storage authentication

serviceAccount:
  create: true
  annotations:
    azure.workload.identity/client-id: "<customer-managed-identity-client-id>"
    azure.workload.identity/tenant-id: "<customer-tenant-id>"
http:
  podLabels:
    azure.workload.identity/use: "true"
worker:
  podLabels:
    azure.workload.identity/use: "true"
streaqWorkerDefaults:
  podLabels:
    azure.workload.identity/use: "true"

serviceAccount:
  create: true
azureWorkloadIdentity:
  enabled: true
  clientId: "<customer-managed-identity-client-id>"
  tenantId: "<customer-tenant-id>"
  authorityHost: https://login.microsoftonline.com/
  audience: api://AzureADTokenExchange
  expirationSeconds: 3600

serviceAccount:
  create: true
env:
  AZURE_CLIENT_ID: "<customer-managed-identity-client-id>"
  AZURE_TENANT_ID: "<customer-tenant-id>"
  AZURE_AUTHORITY_HOST: https://login.microsoftonline.com/
  AZURE_FEDERATED_TOKEN_FILE: /var/run/secrets/azure/tokens/azure-identity-token

#!/usr/bin/env bash
set -euo pipefail
: "${RELEASE_NAME:?Set RELEASE_NAME to the Helm release name}"
work_dir=$(mktemp -d)
trap 'rm -rf "$work_dir"' EXIT
cat > "$work_dir/rendered.yaml"
cat > "$work_dir/kustomization.yaml" <<'YAML'
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
resources: [rendered.yaml]
patches:
YAML

patch_pod() {
  local kind=$1 suffix=$2 container=$3 indent=$4 api=apps/v1
  if [[ "$kind" != Deployment ]]; then api=batch/v1; fi
  local name="${RELEASE_NAME}-reducto-${suffix}"
  cat >> "$work_dir/kustomization.yaml" <<YAML
- target:
    kind: $kind
    name: $name
  patch: |-
    apiVersion: $api
    kind: $kind
    metadata:
      name: $name
    spec:
YAML
  if [[ "$kind" == CronJob ]]; then
    printf '      jobTemplate:\n        spec:\n' >> "$work_dir/kustomization.yaml"
  fi
  cat >> "$work_dir/kustomization.yaml" <<YAML
${indent}template:
${indent}  spec:
${indent}    serviceAccountName: ${RELEASE_NAME}-reducto
${indent}    volumes:
${indent}    - name: azure-identity-token
${indent}      projected:
${indent}        sources:
${indent}        - serviceAccountToken:
${indent}            audience: api://AzureADTokenExchange
${indent}            expirationSeconds: 3600
${indent}            path: azure-identity-token
${indent}    containers:
${indent}    - name: $container
${indent}      volumeMounts:
${indent}      - name: azure-identity-token
${indent}        mountPath: /var/run/secrets/azure/tokens
${indent}        readOnly: true
YAML
}

for suffix in ${AZURE_DEPLOYMENTS:-http http-canary worker priority-worker gpu-worker gpu-ocr inference router-controller streaq-ui streaq-io streaq-cpu streaq-cpu-large}; do
  container="reducto-$suffix"
  if [[ "$suffix" == http-canary ]]; then container=reducto-http; fi
  patch_pod Deployment "$suffix" "$container" '      '
done
patch_pod Job onprem-upgrade-preflight preflight '      '
patch_pod CronJob cleanup reducto-cleanup '          '
patch_pod CronJob retry-stale reducto-retry-stale '          '
kubectl kustomize "$work_dir"

spec:
  serviceAccountName: reducto
  containers:
    - name: reducto
      env:
        - name: AZURE_CLIENT_ID
          value: "<customer-managed-identity-client-id>"
        - name: AZURE_TENANT_ID
          value: "<customer-tenant-id>"
        - name: AZURE_AUTHORITY_HOST
          value: https://login.microsoftonline.com/
        - name: AZURE_FEDERATED_TOKEN_FILE
          value: /var/run/secrets/azure/tokens/azure-identity-token
      volumeMounts:
        - name: azure-identity-token
          mountPath: /var/run/secrets/azure/tokens
          readOnly: true
  volumes:
    - name: azure-identity-token
      projected:
        sources:
          - serviceAccountToken:
              audience: api://AzureADTokenExchange
              expirationSeconds: 3600
              path: azure-identity-token