CSR Metadata request acts as a probe for ImdsV2

[Robbie-Microsoft]

This PR introduces ImdsV2 as a Managed Identity source, and focuses on executing a network request to get metadata to be used in the rest of the flow.

[neha-bhargava]

Need to undo the changes to public API to get the managed identity source

[Robbie-Microsoft]

Need to undo the changes to public API to get the managed identity source

@neha-bhargava: done, after refactoring some code

[bgavrilMS]

I believe @gladjohn said that probe failure occurs exclusively on 404?

[bgavrilMS]

(i.e. delete the catch block)

[bgavrilMS]

@gladjohn to review this. I believe you said probe failure should only happen on 404

[gladjohn]

IF probe returns 404 - then no /metadata endpoint, flows continues with other source detection, if none are found we fallback to IMDS (Kubernetes etc.)

We should pass a "." in the body to the endpoint and if it exists we will get a bad request (400), then we should inspect the header, spec here

We should not throw anywhere if probe fails or if we do not find the endpoint.

something like,

        private bool EvaluateProbeResponse(HttpResponse response)
        {
            if (response == null)
            {
                _logger.Info("[Probe] No response received from the server.");
                return false;
            }

            _logger.Info($"[Probe] Evaluating response from credential endpoint. Status Code: {response.StatusCode}");

            if (response.HeadersAsDictionary.TryGetValue("Server", out string serverHeader) &&
                serverHeader.StartsWith(ImdsHeader, StringComparison.OrdinalIgnoreCase))
            {
                _logger.Info($"[Probe] Credential endpoint supported. Server: {serverHeader}");
                return true;
            }

            _logger.Info($"[Probe] Credential endpoint not supported. Status Code: {response.StatusCode}");
            return false;
        }

[bgavrilMS]

This is not a good way to fail. Just throw exception like InvalidOperationException or smth

[bgavrilMS]

Same comment. ProbeMode only look at 404?

[bgavrilMS]

same comment

[neha-bhargava]

Why not keep this as static as well. The method to get the source was created static so that Azure Identity can detect if managed identity is available before creating the source. Was this discussed with them?

[Robbie-Microsoft]

@neha-bhargava, this method passes the Service Bundle through the ManagedIdentityClient's GetManagedIdentitySourceAsync method, and into ImdsV2ManagedIdentitySource, where the csr metadata probe uses things from the Service Bundle: IdType, UserAssignedId, RetryPolicyFactory, HttpManager, Logger, etc.

[Robbie-Microsoft]

@gladjohn Can you confirm that this would work with Azure Identity? Did you discuss with them?