Skip to content

Commit 6c15935

Browse files
CopilotJonathanCrd
Copilot
and
JonathanCrd
authored
Rename WorkloadIdentityCredential.IsAzureKubernetesTokenProxyEnabled to IsAzureProxyEnabled (#54083)
* Initial plan * Rename IsAzureKubernetesTokenProxyEnabled to EnableAzureProxy Co-authored-by: JonathanCrd <17486462+JonathanCrd@users.noreply.github.com> * Revert CHANGELOG.md change to already-shipped version 1.18.0-beta.1 Co-authored-by: JonathanCrd <17486462+JonathanCrd@users.noreply.github.com> * Rename EnableAzureProxy to IsAzureProxyEnabled for .NET conventions Co-authored-by: JonathanCrd <17486462+JonathanCrd@users.noreply.github.com> --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: JonathanCrd <17486462+JonathanCrd@users.noreply.github.com>
1 parent 3f7410e commit 6c15935

File tree

8 files changed

+15
-13
lines changed

8 files changed

+15
-13
lines changed

‎sdk/identity/Azure.Identity/CHANGELOG.md‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -6,6 +6,8 @@
66

77
### Breaking Changes
88

9+
- Renamed `WorkloadIdentityCredentialOptions.IsAzureKubernetesTokenProxyEnabled` to `IsAzureProxyEnabled` to follow .NET naming conventions for boolean properties.
10+
911
### Bugs Fixed
1012

1113
### Other Changes

‎sdk/identity/Azure.Identity/README.md‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -109,7 +109,7 @@ As of version 1.8.0, `ManagedIdentityCredential` supports [token caching](#token
109109

110110
## Identity binding mode (WorkloadIdentityCredential)
111111

112-
`WorkloadIdentityCredential` supports an opt-in identity binding mode to work around [Entra ID's limit on federated identity credentials (FICs)](https://learn.microsoft.com/entra/workload-id/workload-identity-federation-considerations#federated-identity-credential-considerations) per managed identity. When enabled via the `IsAzureKubernetesTokenProxyEnabled ` option, the credential redirects token requests to an AKS-provided proxy that handles the FIC exchange centrally, allowing multiple pods to share the same identity without hitting FIC limits.
112+
`WorkloadIdentityCredential` supports an opt-in identity binding mode to work around [Entra ID's limit on federated identity credentials (FICs)](https://learn.microsoft.com/entra/workload-id/workload-identity-federation-considerations#federated-identity-credential-considerations) per managed identity. When enabled via the `IsAzureProxyEnabled` option, the credential redirects token requests to an AKS-provided proxy that handles the FIC exchange centrally, allowing multiple pods to share the same identity without hitting FIC limits.
113113

114114
**Note:** This feature is only available when using `WorkloadIdentityCredential` directly. It is not supported by `DefaultAzureCredential` or `ManagedIdentityCredential`.
115115

@@ -118,7 +118,7 @@ As of version 1.8.0, `ManagedIdentityCredential` supports [token caching](#token
118118
```C# Snippet:WorkloadIdentityCredentialWithIdentityBinding
119119
var credential = new WorkloadIdentityCredential(new WorkloadIdentityCredentialOptions
120120
{
121-
IsAzureKubernetesTokenProxyEnabled = true // Enable identity binding mode
121+
IsAzureProxyEnabled = true // Enable identity binding mode
122122
});
123123
```
124124

@@ -142,7 +142,7 @@ If you're currently using `ManagedIdentityCredential` for workload identity in A
142142
// After (with identity binding support):
143143
var credential = new WorkloadIdentityCredential(new WorkloadIdentityCredentialOptions
144144
{
145-
IsAzureKubernetesTokenProxyEnabled = true
145+
IsAzureProxyEnabled = true
146146
});
147147
```
148148

‎sdk/identity/Azure.Identity/api/Azure.Identity.net8.0.cs‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -502,7 +502,7 @@ public WorkloadIdentityCredentialOptions() { }
502502
public System.Collections.Generic.IList<string> AdditionallyAllowedTenants { get { throw null; } }
503503
public string ClientId { get { throw null; } set { } }
504504
public bool DisableInstanceDiscovery { get { throw null; } set { } }
505-
public bool IsAzureKubernetesTokenProxyEnabled { get { throw null; } set { } }
505+
public bool IsAzureProxyEnabled { get { throw null; } set { } }
506506
public string TenantId { get { throw null; } set { } }
507507
public string TokenFilePath { get { throw null; } set { } }
508508
}

‎sdk/identity/Azure.Identity/api/Azure.Identity.netstandard2.0.cs‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -499,7 +499,7 @@ public WorkloadIdentityCredentialOptions() { }
499499
public System.Collections.Generic.IList<string> AdditionallyAllowedTenants { get { throw null; } }
500500
public string ClientId { get { throw null; } set { } }
501501
public bool DisableInstanceDiscovery { get { throw null; } set { } }
502-
public bool IsAzureKubernetesTokenProxyEnabled { get { throw null; } set { } }
502+
public bool IsAzureProxyEnabled { get { throw null; } set { } }
503503
public string TenantId { get { throw null; } set { } }
504504
public string TokenFilePath { get { throw null; } set { } }
505505
}

‎sdk/identity/Azure.Identity/src/Credentials/WorkloadIdentityCredential.cs‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -45,7 +45,7 @@ public WorkloadIdentityCredential(WorkloadIdentityCredentialOptions options)
4545
clientAssertionCredentialOptions.MsalClient = options.MsalClient;
4646

4747
// Configure Kubernetes token proxy if user opted in
48-
if (options.IsAzureKubernetesTokenProxyEnabled)
48+
if (options.IsAzureProxyEnabled)
4949
{
5050
var proxyConfig = KubernetesProxyConfig.TryCreate();
5151
if (proxyConfig != null)

‎sdk/identity/Azure.Identity/src/Credentials/WorkloadIdentityCredentialOptions.cs‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -44,7 +44,7 @@ public class WorkloadIdentityCredentialOptions : TokenCredentialOptions, ISuppor
4444
/// When enabled and proxy configuration environment variables are set, requests are sent to the AKS proxy instead of directly to Entra ID.
4545
/// This feature is not supported when using DefaultAzureCredential.
4646
/// </summary>
47-
public bool IsAzureKubernetesTokenProxyEnabled { get; set; }
47+
public bool IsAzureProxyEnabled { get; set; }
4848

4949
/// <summary>
5050
/// Specifies tenants in addition to the specified <see cref="TenantId"/> for which the credential may acquire tokens.

‎sdk/identity/Azure.Identity/tests/WorkloadIdentityCredentialTests.cs‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -136,7 +136,7 @@ public void KubernetesProxy_OptInWithoutEnvVars_NoError()
136136
TenantId = TenantId,
137137
ClientId = ClientId,
138138
TokenFilePath = tokenFilePath,
139-
IsAzureKubernetesTokenProxyEnabled = true,
139+
IsAzureProxyEnabled = true,
140140
MsalClient = mockConfidentialMsalClient,
141141
Pipeline = CredentialPipeline.GetInstance(null)
142142
};
@@ -157,7 +157,7 @@ public void KubernetesProxy_InvalidProxyUrl_ThrowsInvalidOperation()
157157
TenantId = TenantId,
158158
ClientId = ClientId,
159159
TokenFilePath = tokenFilePath,
160-
IsAzureKubernetesTokenProxyEnabled = true,
160+
IsAzureProxyEnabled = true,
161161
MsalClient = mockConfidentialMsalClient,
162162
Pipeline = CredentialPipeline.GetInstance(null)
163163
};
@@ -198,7 +198,7 @@ public void KubernetesProxy_BothCaFileAndCaData_ThrowsInvalidOperation()
198198
TenantId = TenantId,
199199
ClientId = ClientId,
200200
TokenFilePath = tokenFilePath,
201-
IsAzureKubernetesTokenProxyEnabled = true,
201+
IsAzureProxyEnabled = true,
202202
MsalClient = mockConfidentialMsalClient,
203203
Pipeline = CredentialPipeline.GetInstance(null)
204204
};
@@ -226,7 +226,7 @@ public void KubernetesProxy_CaFileDoesNotExist_ThrowsInvalidOperation()
226226
TenantId = TenantId,
227227
ClientId = ClientId,
228228
TokenFilePath = tokenFilePath,
229-
IsAzureKubernetesTokenProxyEnabled = true,
229+
IsAzureProxyEnabled = true,
230230
MsalClient = mockConfidentialMsalClient,
231231
Pipeline = CredentialPipeline.GetInstance(null)
232232
};

‎sdk/identity/Azure.Identity/tests/samples/ReadmeSnippets.cs‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -68,7 +68,7 @@ public void WorkloadIdentityCredentialWithIdentityBinding()
6868
#region Snippet:WorkloadIdentityCredentialWithIdentityBinding
6969
var credential = new WorkloadIdentityCredential(new WorkloadIdentityCredentialOptions
7070
{
71-
IsAzureKubernetesTokenProxyEnabled = true // Enable identity binding mode
71+
IsAzureProxyEnabled = true // Enable identity binding mode
7272
});
7373
#endregion
7474
}
@@ -86,7 +86,7 @@ public void MigrationToWorkloadIdentityCredential()
8686
// After (with identity binding support):
8787
var credential = new WorkloadIdentityCredential(new WorkloadIdentityCredentialOptions
8888
{
89-
IsAzureKubernetesTokenProxyEnabled = true
89+
IsAzureProxyEnabled = true
9090
});
9191
#endregion
9292
}

0 commit comments

Comments
 (0)