litellm/tests/test_litellm/secret_managers
github-actions[bot] fc042a299a fix(azure): prefer workload identity over managed identity
AKS workload identity injects AZURE_CLIENT_ID, AZURE_TENANT_ID, and
AZURE_FEDERATED_TOKEN_FILE into the pod, and never a client secret.
Reading that bare client id as a managed identity sent the pod to IMDS,
which has no identity attached to it, so the token request failed and the
federated token was never exchanged.

AZURE_FEDERATED_TOKEN_FILE now wins over the bare client id and infers
DefaultAzureCredential, whose chain reaches WorkloadIdentityCredential
before ManagedIdentityCredential. DefaultAzureCredential passes
AZURE_CLIENT_ID to both legs, so a plain user-assigned managed identity
still reaches the same identity it does today.

This is the credential path Azure recommends for passwordless Postgres on
AKS, and it also fixes the Azure OpenAI token provider, which infers its
credential the same way.
2026-08-20 13:45:56 -07:00
..
test_aws_secret_manager_replication.py chore: litellm oss staging160626 (#30527) 2026-06-16 18:23:13 -07:00
test_aws_secret_manager_rotation.py style: run black formatter on files from main merge 2026-04-17 13:02:59 -07:00
test_aws_secret_manager_v2.py fix(tests): isolate flaky files endpoint tests from global proxy state (#21788) 2026-02-21 11:20:32 -08:00
test_base_secret_manager.py fix(proxy): harden secret name validation for external secret manager integrations (LIT-4201) (#32092) 2026-07-08 10:36:00 -07:00
test_custom_secret_manager.py style: run black formatter on files from main merge 2026-04-17 13:02:59 -07:00
test_get_azure_ad_token_provider.py fix(azure): prefer workload identity over managed identity 2026-08-20 13:45:56 -07:00
test_secret_managers_main.py fix(proxy): initialize the secret manager before resolving os.environ config references (#37544) 2026-08-19 17:00:26 -07:00