[aks-agent] Add Microsoft Entra ID authentication support for Azure OpenAI by mainred · Pull Request #9719 · Azure/azure-cli-extensions

mainred · 2026-03-25T08:21:22Z

Summary

Add support for keyless authentication using Microsoft Entra ID for Azure OpenAI
Allow users to skip providing an API key during initialization to enable workload identity-based authentication
Configure aks-agent pod to use the same service account as aks-mcp pod with workload identity enabled

Changes

Bump version to 1.0.0b22 and aks-agent to v0.7.1
Allow empty API key during Azure OpenAI configuration with hint message
Configure helm values for aks-agent pod: workloadIdentity.enabled=true, serviceAccount.create=false, and use the same service account name as aks-mcp
Skip creating secrets and environment variables when API key is empty
Enable azureADTokenAuth flag in helm when API key is not provided

Test plan

Test initialization with empty API key for Azure OpenAI
Verify helm values include workloadIdentity and serviceAccount configuration
Verify aks-agent pod uses the same service account as aks-mcp
Test Azure OpenAI authentication with workload identity

…penAI This commit adds support for keyless authentication using Microsoft Entra ID (formerly Azure AD) for Azure OpenAI. Users can now skip providing an API key during initialization to enable workload identity-based authentication. Changes: - Bump version to 1.0.0b22 and aks-agent to v0.7.0 - Allow empty API key during Azure OpenAI configuration - Configure aks-agent pod to use workload identity with the same service account as aks-mcp - Add helm values: workloadIdentity.enabled=true, serviceAccount.create=false - Skip creating secrets and environment variables when API key is empty - Enable azureADTokenAuth flag in helm when API key is not provided

azure-client-tools-bot-prd · 2026-03-25T08:21:26Z

⚠️Azure CLI Extensions Breaking Change Test

⚠️aks-agent

rule cmd_name rule_message suggest_message

⚠️ 1006 - ParaAdd aks agent-cleanup cmd aks agent-cleanup added parameter yes

yonzhan · 2026-03-25T08:21:46Z

Thank you for your contribution! We will review the pull request and get back to you soon.

github-actions · 2026-03-25T08:21:50Z

The git hooks are available for azure-cli and azure-cli-extensions repos. They could help you run required checks before creating the PR.

Please sync the latest code with latest dev branch (for azure-cli) or main branch (for azure-cli-extensions).
After that please run the following commands to enable git hooks:

pip install azdev --upgrade
azdev setup -c <your azure-cli repo path> -r <your azure-cli-extensions repo path>

github-actions · 2026-03-25T08:25:52Z

For more info about extension versioning, please refer to Extension version schema

Copilot

Pull request overview

Adds keyless (Microsoft Entra ID / workload identity) authentication support for Azure OpenAI in the aks-agent extension, allowing initialization without providing an API key and propagating the necessary Helm values for agent deployment.

Changes:

Bump extension version to 1.0.0b22 and aks-agent chart/image version to 0.7.0.
Allow empty api_key for Azure OpenAI and omit secret/env wiring when the key is blank.
Set Helm values to enable workload identity/service account usage and toggle azureADTokenAuth when keyless auth is detected.

Reviewed changes

Copilot reviewed 7 out of 7 changed files in this pull request and generated 6 comments.

Show a summary per file

File	Description
src/aks-agent/setup.py	Version bump to `1.0.0b22`.
src/aks-agent/azext_aks_agent/agent/llm_providers/base.py	Skip secret/env substitution when `api_key` is empty.
src/aks-agent/azext_aks_agent/agent/llm_providers/azure_provider.py	Allow empty API key and short-circuit validation for keyless path.
src/aks-agent/azext_aks_agent/agent/llm_config_manager.py	Avoid generating env var refs when `api_key` is blank.
src/aks-agent/azext_aks_agent/agent/k8s/aks_agent_manager.py	Add Helm values for workload identity + `azureADTokenAuth` toggle.
src/aks-agent/azext_aks_agent/_consts.py	Bump `AKS_AGENT_VERSION` to `0.7.0`.
src/aks-agent/HISTORY.rst	Changelog entry for `1.0.0b22`.

src/aks-agent/azext_aks_agent/agent/llm_providers/base.py

src/aks-agent/azext_aks_agent/agent/llm_providers/azure_provider.py

src/aks-agent/azext_aks_agent/agent/k8s/aks_agent_manager.py

src/aks-agent/azext_aks_agent/agent/llm_providers/base.py

- Split Azure OpenAI provider into two separate providers: - Azure OpenAI (API Key): Requires API key authentication - Azure OpenAI (Microsoft Entra ID): Supports keyless authentication - Add role assignment reminders in helm deployment for keyless auth - Add --yes/-y flag to agent-cleanup command to skip confirmation - Change secret empty data message from warning to debug level - Bump to v0.7.1 (suppress litellm debug logs)

mainred · 2026-03-26T06:53:00Z

cc @yanzhudd

gossion

Overall this PR adds a useful feature for keyless Azure OpenAI authentication. I left a few comments on specific areas worth discussing.

gossion · 2026-03-27T05:25:45Z

src/aks-agent/azext_aks_agent/agent/llm_providers/__init__.py

@@ -19,11 +20,11 @@

 _PROVIDER_CLASSES: List[LLMProvider] = [


Potential bug: PROVIDER_REGISTRY key collision

Both AzureProvider and AzureEntraIDProvider have model_route = "azure", which means their name property (derived from model_route) is both "azure". If PROVIDER_REGISTRY is keyed by name, the second registration (AzureEntraIDProvider) will silently overwrite the first (AzureProvider).

This could cause issues when looking up a provider by name. Consider giving AzureEntraIDProvider a distinct name (e.g., by overriding the name property to return "azure_entraid").

It's by design. We want two kinds of azure openai.

gossion · 2026-03-27T05:25:45Z

src/aks-agent/azext_aks_agent/agent/k8s/aks_agent_manager.py

+            "enabled": True,
+        }
+        helm_values["serviceAccount"] = {
+            "create": False,


workload identity is enabled unconditionally for all deployments

These Helm values (workloadIdentity.enabled=true, serviceAccount.create=false) are set for every deployment, even when the user is purely using API key authentication and does not have workload identity configured on their cluster.

This could cause deployment failures or unexpected behavior on clusters without workload identity. Consider gating this behind the has_empty_api_key check below:

has_empty_api_key = any( not (model_config.get("api_key") or "").strip() for model_config in self.llm_config_manager.model_list.values() ) if has_empty_api_key: helm_values["workloadIdentity"] = {"enabled": True} helm_values["serviceAccount"] = { "create": False, "name": self.aks_mcp_service_account_name, } helm_values["azureADTokenAuth"] = True

It's also by design. It's ok to not have workload identity.

gossion · 2026-03-27T05:25:45Z

src/aks-agent/azext_aks_agent/agent/llm_providers/azure_entraid_provider.py

+        }
+
+    def validate_connection(self, params: dict) -> Tuple[str, str]:
+        api_base = params.get("api_base")


Unlike AzureProvider.validate_connection, this method only checks parameter presence and does not actually validate the connection to the Azure OpenAI endpoint. This is understandable since the Entra ID token is not available at CLI configuration time (it will be obtained by the pod via workload identity).

However, it would be helpful to add a comment here explaining why connection validation is skipped, so future maintainers don't mistake this for an incomplete implementation.

def validate_connection(self, params: dict) -> Tuple[str, str]: # Connection validation is skipped for Entra ID auth because the token # is obtained at runtime via workload identity, not available at CLI config time. ...

We cannot check validation for keyless auzre openai because it relies on azure role of the current user.

gossion · 2026-03-27T05:25:45Z

src/aks-agent/azext_aks_agent/agent/k8s/aks_agent_manager.py

+
+        has_empty_api_key = any(
+            not model_config.get("api_key") or not model_config.get("api_key").strip()
+            for model_config in self.llm_config_manager.model_list.values()


Nit: the empty api_key condition can be simplified. The or short-circuit already handles None/empty string, so the second .strip() check only adds value for whitespace-only strings. A simpler equivalent:

has_empty_api_key = any( not (model_config.get("api_key") or "").strip() for model_config in self.llm_config_manager.model_list.values() )

each llm provider with check the emptiness of the apikey

gossion · 2026-03-27T05:25:45Z

src/aks-agent/azext_aks_agent/custom.py

+            console.print(
+                f"\n⚠️  IMPORTANT: If using keyless authentication with Azure OpenAI, ensure the 'Cognitive Services OpenAI User' or 'Azure AI Developer' role "
+                f"is assigned to the workload identity (service account: {service_account_name}).",
+                style=f"bold {INFO_COLOR}"


This Entra ID detection + warning block is duplicated almost identically in the helm_status == "not_found" branch below. Consider extracting it into a helper function like _warn_entraid_role_assignment(console, model_list, service_account_name) to reduce duplication.

This minor change can be included in a following PR.

gossion · 2026-03-27T05:25:45Z

src/aks-agent/HISTORY.rst

 Pending
 +++++++

+1.0.0b22


Minor: HISTORY.rst says "Bump aks-agent to v0.7.1" but the PR description says "v0.7.0". The code in _consts.py matches the changelog (v0.7.1). Please update the PR description to be consistent.

gossion

lgtm

mainred requested review from feiskyer and nilo19 as code owners March 25, 2026 08:21

Copilot AI review requested due to automatic review settings March 25, 2026 08:21

azure-client-tools-bot-prd bot added this to the April 2026 (2026-04-07) milestone Mar 25, 2026

microsoft-github-policy-service bot requested review from FumingZhang, yanzhudd, yonzhan and zhoxing-ms March 25, 2026 08:21

Copilot started reviewing on behalf of mainred March 25, 2026 08:22 View session

microsoft-github-policy-service bot assigned yanzhudd and zhoxing-ms Mar 25, 2026

microsoft-github-policy-service bot added Auto-Assign Auto assign by bot AKS labels Mar 25, 2026

Copilot AI reviewed Mar 25, 2026

View reviewed changes

yonzhan unassigned zhoxing-ms Mar 25, 2026

mainred force-pushed the support-entra-id branch from 36dfbee to 643eb7d Compare March 26, 2026 04:17

fix style check errors

a4c1447

gossion reviewed Mar 27, 2026

View reviewed changes

gossion approved these changes Mar 27, 2026

View reviewed changes

               Pending
               +++++++
+.0.0b22

Conversation

mainred commented Mar 25, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Changes

Test plan

Uh oh!

azure-client-tools-bot-prd bot commented Mar 25, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

yonzhan commented Mar 25, 2026

Uh oh!

github-actions bot commented Mar 25, 2026

Uh oh!

github-actions bot commented Mar 25, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

mainred commented Mar 26, 2026

Uh oh!

gossion left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

gossion left a comment

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

6 participants

mainred commented Mar 25, 2026 •

edited

Loading

azure-client-tools-bot-prd bot commented Mar 25, 2026 •

edited

Loading