Struct WorkloadIdentityCredential 

pub struct WorkloadIdentityCredential { /* private fields */ }

Authenticates via Microsoft Entra Workload ID (Azure Kubernetes Service workload identity federation): exchanges a Kubernetes projected service-account token for an Entra access token using the OAuth2 client-credentials grant with a JWT client assertion (POST {authority}/{tenant}/oauth2/v2.0/token, client_assertion_type=urn:ietf:params:oauth:client-assertion-type:jwt-bearer).

By default tenant_id, client_id, and the federated token file path are read from AZURE_TENANT_ID, AZURE_CLIENT_ID, and AZURE_FEDERATED_TOKEN_FILE — the variables the AKS workload identity webhook injects into a pod — mirroring azure_identity’s WorkloadIdentityCredential. The token file is re-read on every token request (not cached once at startup), since the kubelet periodically rotates the projected token.

Implementations

impl WorkloadIdentityCredential

pub fn new(scope: impl Into<String>) -> Result<Self>

Read AZURE_TENANT_ID, AZURE_CLIENT_ID, and AZURE_FEDERATED_TOKEN_FILE from the environment, acquiring tokens for scope.

Errors

Error::Configuration naming every missing variable, when one or more of the three are unset.

pub fn with_overrides( scope: impl Into<String>, tenant_id: Option<String>, client_id: Option<String>, token_file_path: Option<String>, ) -> Result<Self>

Same as new, but the tenant id, client id, and/or federated-token-file path can be supplied directly instead of read from the environment. Pass None for a field to keep reading it from the usual environment variable.

Errors

Error::Configuration naming every value that is neither passed here nor found in the environment.

pub fn with_client_id( scope: impl Into<String>, client_id: Option<String>, ) -> Result<Self>

Same as new, overriding only the client id (default: AZURE_CLIENT_ID) — e.g. to authenticate as an app registration whose federated credential trusts this pod’s service account token, distinct from the identity the AKS webhook injects by default.

pub fn with_authority(self, authority: impl Into<String>) -> Self

Override the Entra authority (default DEFAULT_AUTHORITY) — e.g. a sovereign cloud, or a loopback in tests.

Trait Implementations

impl TokenCredential for WorkloadIdentityCredential

fn get_token<'life0, 'async_trait>( &'life0 self, ) -> Pin<Box<dyn Future<Output = Result<String>> + Send + 'async_trait>>

where Self: 'async_trait, 'life0: 'async_trait,

Fetch a bearer token to send as Authorization: Bearer <token>.

fn get_token_for_scope<'life0, 'life1, 'async_trait>( &'life0 self, scope: &'life1 str, ) -> Pin<Box<dyn Future<Output = Result<String>> + Send + 'async_trait>>

where Self: 'async_trait, 'life0: 'async_trait, 'life1: 'async_trait,

Fetch a bearer token for a specific scope (audience), e.g. "https://ai.azure.com/.default".