Add Azure DevOps workload identity support - #3272
Open
abhiramaab wants to merge 2 commits into
Open
Conversation
Contributor
There was a problem hiding this comment.
Pull request overview
Adds Azure DevOps (dev.azure.com) workload identity authentication to Spring Cloud Config Server’s JGit transport customization path, driven by new git properties (client-id, managed-identity-enabled) and an optional Azure Identity dependency.
Changes:
- Introduces
AzureDevOpsWorkloadIdentitySupportto acquire managed identity tokens and injectAuthorization: Bearer …into JGit HTTP transport for Azure DevOps repos. - Extends transport callback selection to prefer Azure DevOps workload identity when enabled (while preserving existing custom callback / GCP / SSH fallback behavior).
- Adds configuration + unit tests and wires an optional
azure-identitydependency.
Reviewed changes
Copilot reviewed 10 out of 10 changed files in this pull request and generated 5 comments.
Show a summary per file
| File | Description |
|---|---|
| spring-cloud-config-server/src/main/java/org/springframework/cloud/config/server/support/TransportConfigCallbackFactory.java | Adds Azure DevOps workload identity callback selection ahead of SSH fallback. |
| spring-cloud-config-server/src/main/java/org/springframework/cloud/config/server/support/AzureDevOpsWorkloadIdentitySupport.java | New helper to detect dev.azure.com HTTP(S) repos and inject bearer tokens into JGit HTTP transport. |
| spring-cloud-config-server/src/main/java/org/springframework/cloud/config/server/environment/JGitEnvironmentProperties.java | Adds clientId and managedIdentityEnabled configuration properties. |
| spring-cloud-config-server/src/main/java/org/springframework/cloud/config/server/config/EnvironmentRepositoryConfiguration.java | Wires optional Azure DevOps support into the JGit factory configuration and imports Azure configuration. |
| spring-cloud-config-server/src/main/java/org/springframework/cloud/config/server/config/AzureDevOpsWorkloadIdentityConfiguration.java | Conditional configuration that exposes AzureDevOpsWorkloadIdentitySupport when Azure Identity + JGit are present. |
| spring-cloud-config-server/src/test/java/org/springframework/cloud/config/server/support/TransportConfigCallbackFactoryTests.java | New tests for callback selection behavior (Azure vs disabled vs other repo). |
| spring-cloud-config-server/src/test/java/org/springframework/cloud/config/server/support/AzureDevOpsWorkloadIdentitySupportTests.java | New tests for URI handling and header injection behavior. |
| spring-cloud-config-server/src/test/java/org/springframework/cloud/config/server/config/EnvironmentRepositoryConfigurationTests.java | Adds a context test asserting the Azure support bean is present. |
| spring-cloud-config-server/pom.xml | Adds optional com.azure:azure-identity dependency. |
| pom.xml | Adds ${azure-identity.version} property. |
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
Comment on lines
+64
to
+67
| when(properties.getUri()).thenReturn(AZURE_DEVOPS_REPO); | ||
| when(properties.isManagedIdentityEnabled()).thenReturn(false); | ||
| when(azureSupport.canHandle(AZURE_DEVOPS_REPO)).thenReturn(true); | ||
|
|
Comment on lines
+51
to
+55
| TransportConfigCallback createTransportConfigCallback(TokenCredential credential) { | ||
| return transport -> { | ||
| if (transport instanceof TransportHttp && canHandle(transport.getURI().toString())) { | ||
| AccessToken accessToken = credential.getToken(new TokenRequestContext().addScopes(AZURE_DEVOPS_SCOPE)) | ||
| .block(); |
Signed-off-by: abhiramaab <abhiram.b@icloud.com>
…pport - Remove TokenCredential from package-private API in AzureDevOpsWorkloadIdentitySupport using Supplier<String> to prevent NoClassDefFoundError when optional azure-identity dependency is missing. - Make clientId optional in createTransportConfigCallback to use system-assigned managed identity when clientId is null/blank. - Update test cases in AzureDevOpsWorkloadIdentitySupportTests and TransportConfigCallbackFactoryTests to properly stub properties and verify method interactions. Signed-off-by: abhiramaab <abhiram.b@icloud.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes #3270
This adds workload identity authentication for Git repositories hosted on Azure DevOps (dev.azure.com), using the proposed client-id and managed-identity-enabled configuration properties.
Implementation includes:
Validation: