Add support for Azure DevOps pipeline OIDC auth

[jrpbc]

Background

The template-infra-azure currently has capabilites to establish OIDC-based federated identity between GitHub Actions and Azure through module auth-github-actions. This module creates an Azure AD app registration, service principal, federated identity credential, and the necessary role assignments.

Some projects also use Azure DevOps Pipelines as a CI/CD provider. The template-infra-azure needs the capabilities to establish OIDC-based federated identity between Azure DevOps and Azure.

Technical Considerations

• Unlike Github, ADO OIDC subject claims are not customizable, and we must structure the OIDC claim as provided by Azure DevOps

Technical Implementation Approach

• Create infra/modules/auth-ado-pipelines/:
  • main.tf — define to mirror auth-github-actions/main.tf but with azureadd_application_federated_identity_credential using a Azure DevOps OIDC issuer URL and subject claim
  • Same role assignments as the GitHub module (Contributor, Key Vault Secrets Officer, Key Vault Certificates Officer, RBAC Administrator, Storage Blob Data Contributor on tf state)
  • variables.tf - inputs:
    • name - display name for the Azure AD app registration
    • ado_organization_id - ADO org GUID (used in issuer URL)
    • ado_organization_name - ADO org name (used in subject claim)
    • ado_project - ADO project name
    • ado_service_connection_name -
    • tf_state_storage_container_scope
    • `resource_owners
  • outputs.tf - expose client_id and object_id (same as auth-github-actions)
• Add ci_cd_provider variable to project-config:
  ci_cd_provider = "github" # or "azure_devops"
  Also add ADO-specific locals (only required when ci_cd_provider = "azure_devops"):
  • ado_organization_id - ADO org GUID (used in issuer URL)
  • ado_organization_name - ADO org name
  • ado_project - ADO project name
    Expose all of these via outputs.tf
• Wire up in infra/accounts/main.tf- Use project-config ci_cd_provider to conditionally instantiate the appropriate auth module: auth_ado_pipeline or auth_github_actions

Document Setup flow in docs/infra/set-up-azure-devops.md (equivalent of docs/infra/set-up-github.md):

1. Setup project-config/main.tf local variable ci_cd_provider
2. Run make infra-set-up-account → Terraform creates the Azure AD app + federated credential
3. Note the client_id from the auth_ado_pipelines outputs
4. Create the ADO service connection (Workload Identity Federation type) using that client_id - the connection name must match ado_service_connection_name

Out of scope

• no bin/set-up-github equivalent script needed - ADO subject claims are not customizable.