OCPBUGS-74245: Azure - Fix system-assigned managed identity authentication

[jianlinliu]

When using system-assigned managed identity on Azure, the installer
fails to create resources because the AzureClusterIdentity manifest
is incorrectly configured with UserAssignedMSI type but no ClientID.

Root Cause:

When using system-assigned managed identity per Azure documentation,
users only provide subscriptionId and tenantId in osServicePrincipal.json
(no clientId). The installer correctly detects this as ManagedIdentityAuth,
but then sets the CAPZ AzureClusterIdentity type to UserAssignedMSI
with an empty ClientID field.

CAPZ (Cluster API Provider Azure) requires a ClientID when using
UserAssignedMSI type, causing the cluster infrastructure provisioning
to fail during bootstrap.

Fix:

Only set the ClientID field in AzureClusterIdentity when it's not empty.
This allows CAPZ to properly handle system-assigned managed identity
where no explicit client ID is needed - the system will use the
managed identity automatically assigned to the VM.

[openshift-ci-robot]

@jianlinliu: This pull request references Jira Issue OCPBUGS-74245, which is invalid:

• expected the bug to target the "4.22.0" version, but no target version was set

Comment /jira refresh to re-evaluate validity if changes to the Jira bug are made, or edit the title of this pull request to link to a different bug.

The bug has been updated to refer to the pull request using the external bug tracker.

Details

In response to this:

When using system-assigned managed identity on Azure, the installer
fails to create resources because the AzureClusterIdentity manifest
is incorrectly configured with UserAssignedMSI type but no ClientID.

Root Cause:

When using system-assigned managed identity per Azure documentation,
users only provide subscriptionId and tenantId in osServicePrincipal.json
(no clientId). The installer correctly detects this as ManagedIdentityAuth,
but then sets the CAPZ AzureClusterIdentity type to UserAssignedMSI
with an empty ClientID field.

CAPZ (Cluster API Provider Azure) requires a ClientID when using
UserAssignedMSI type, causing the cluster infrastructure provisioning
to fail during bootstrap.

Fix:

Only set the ClientID field in AzureClusterIdentity when it's not empty.
This allows CAPZ to properly handle system-assigned managed identity
where no explicit client ID is needed - the system will use the
managed identity automatically assigned to the VM.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[openshift-ci]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
Once this PR has been reviewed and has the lgtm label, please assign sadasu for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• pkg/asset/manifests/azure/OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[jianlinliu]

/payload-job periodic-ci-openshift-verification-tests-main-installation-nightly-4.22-azure-ipi-oidc-managed-identity-system-f14

[openshift-ci]

@jianlinliu: trigger 1 job(s) for the /payload-(with-prs|job|aggregate|job-with-prs|aggregate-with-prs) command

• periodic-ci-openshift-verification-tests-main-installation-nightly-4.22-azure-ipi-oidc-managed-identity-system-f14

See details on https://pr-payload-tests.ci.openshift.org/runs/ci/b403cb30-17ab-11f1-84df-ae537f7631ca-0

[jianlinliu]

/payload-job periodic-ci-openshift-verification-tests-main-installation-nightly-4.21-azure-ipi-oidc-managed-identity-system-f14

[openshift-ci]

@jianlinliu: trigger 1 job(s) for the /payload-(with-prs|job|aggregate|job-with-prs|aggregate-with-prs) command

• periodic-ci-openshift-verification-tests-main-installation-nightly-4.21-azure-ipi-oidc-managed-identity-system-f14

See details on https://pr-payload-tests.ci.openshift.org/runs/ci/4189f870-17d5-11f1-9f13-4837963c9429-0

[patrickdillon]

It looks like upstream CAPZ does not support system assigned identities. I've opened kubernetes-sigs/cluster-api-provider-azure#6152 which would fix us.

Also proposed a workaround of retrieving the client id: #10367 But I'm not so sure we should do that