Enable Authenticating with Azure with Certificates using Azure SDK for Go's Generic NewDefaultAzureCredential

[bryan-cox]

This enhancement proposes enabling image registry, ingress, cloud network config, and storage operators(azure-file and azure-disk) to accept authenticating with Azure with certificates using Azure SDK for Go's generic function NewDefaultAzureCredential.

1. Ingress - Refactor to use Azure SDK default cred chain
2. Image Registry - Refactor to use Azure SDK default cred chain
3. Cluster Network Operator PR
4. Cloud Network Config - Refactor to use Azure SDK default cred chain
5. Cluster Storage Operator PR
6. CSI Operator - Separate Azure Authentication for Azure File and Disk - TBD adding the secrets CSI volume and volume mount for Azure file and disk

[openshift-ci]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
Once this PR has been reviewed and has the lgtm label, please assign enxebre for approval. For more information see the Kubernetes Code Review Process.

The full list of commands accepted by this bot can be found here.

Needs approval from an approver in each of these files:

• enhancements/hypershift/OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[bennerv]

Also should capture AZURE_CLIENT_SEND_CERTIFICATE_CHAIN but you said there's be followup.

Otherwise lgtm

[flavianmissi]

Left a question about the image registry (operand). Looks good otherwise!

[flavianmissi]

When configured with workload identity, the image registry operator will configure the image registry in a similar fashion to what's described in this EP (source).
Do we need to consider this when changing the operator code to use these env vars? In other words, do we also want the image registry (operand!) to authenticate using this proposed mechanism?

[bryan-cox]

Yeah probably so. On ARO HCP, on the HCP side image registry will authenticate with the cert method, while the operand would use workload identity.

[openshift-ci]

@bryan-cox: The following test failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
ci/prow/markdownlint	c1e875c	link	true	/test markdownlint

Full PR test history. Your PR dashboard.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.