WorkloadIdentityTokenProvider

Exchanges the projected service account token AKS’s workload identity webhook mounts into the pod for a Storage-scoped Azure AD access token, via the OAuth2 JWT-bearer client-assertion flow.

Needs no secret: the assertion is the federated token file, not a client secret.

WorkloadIdentityTokenProvider::fromEnvironment() reads the four variables the webhook injects (AZURE_TENANT_ID, AZURE_CLIENT_ID, AZURE_FEDERATED_TOKEN_FILE, AZURE_AUTHORITY_HOST), the same ones the official Azure SDKs’ WorkloadIdentityCredential reads, so a pod annotated for workload identity needs no Quiote-specific configuration at all.

Synopsis

final class WorkloadIdentityTokenProvider implements AzureTokenProvider


Implements	`AzureTokenProvider`
Source	`WorkloadIdentityTokenProvider.php`

Constructor

__construct()

public function __construct(ClientInterface $httpClient, string $tenantId, string $clientId, string $federatedTokenFile, string $authorityHost = 'https://login.microsoftonline.com/', Psr17Factory $psr17 = new Psr17Factory(…), string $scope = 'https://storage.azure.com/.default'): mixed

Parameter	Type	Description
`$httpClient`	`ClientInterface`
`$tenantId`	`string`
`$clientId`	`string`
`$federatedTokenFile`	`string`
`$authorityHost`	`string`
`$psr17`	`Psr17Factory`
`$scope`	`string`

Returns mixed

Methods

Method	Description
`fromEnvironment(ClientInterface $httpClient, Psr17Factory $psr17 = new Psr17Factory(…), string $scope = 'https://storage.azure.com/.default'): WorkloadIdentityTokenProvider`
`getToken(): string`

fromEnvironment()

public static function fromEnvironment(ClientInterface $httpClient, Psr17Factory $psr17 = new Psr17Factory(…), string $scope = 'https://storage.azure.com/.default'): WorkloadIdentityTokenProvider

Parameter	Type	Description
`$httpClient`	`ClientInterface`
`$psr17`	`Psr17Factory`
`$scope`	`string`

Returns WorkloadIdentityTokenProvider

Throws	When
`AzureStorageException`	If any of the four AKS workload identity variables is missing from the environment.

getToken()

public function getToken(): string

Returns string