handle Entra auth for ASO API managed clusters

[nojnhuh]

What type of PR is this?
/kind bug

What this PR does / why we need it:

There are two commits here. The first adds an implementation of a cache that remembers azcore.TokenCredentials based on the auth parameters like type, tenant ID, client ID. TokenCredentials take care of fetching new access tokens themselves when they expire, so CAPZ should be able to keep them around in the cache indefinitely. Later I plan to hook this cache into AzureClusterIdentity for #1077.

The second commit ports similar logic from #4008 from the AzureManagedControlPlane API to AzureASOManagedControlPlane to handle AKS clusters with local accounts disabled. I added docs with more context.

The cache is necessary because CAPZ needs a way to get the same access token multiple times across reconciles so it doesn't get stuck in a cycle of:

• reconcile an AzureASOManagedControlPlane
• create a new TokenCredential
• fetch an access token
• update the kubeconfig Secret
• observe that the kubeconfig Secret changed and requeue the AzureASOManagedControlPlane

With the same TokenCredential handle, repeated calls to GetToken() will return the same access token until the current one expires, and then it will return a new one.

Which issue(s) this PR fixes (optional, in fixes #<issue number>(, fixes #<issue_number>, ...) format, will close the issue(s) when PR gets merged):
Fixes #5017

Special notes for your reviewer:

I plan to cover this with e2e tests via AKS Automatic in #5208.

• cherry-pick candidate

TODOs:

• squashed commits
• includes documentation
• adds unit tests

Release note:

Fixed a bug preventing Cluster API from authenticating to ASOAPI Managed Clusters with local accounts disabled.

[codecov]

Codecov Report

Attention: Patch coverage is 65.60510% with 108 lines in your changes missing coverage. Please review.

Project coverage is 52.99%. Comparing base (976f893) to head (dd9b8dc).
Report is 85 commits behind head on main.

Files with missing lines	Patch %	Lines
azure/credential_cache.go	15.78%	64 Missing ⚠️
...trollers/azureasomanagedcontrolplane_controller.go	57.14%	15 Missing and 6 partials ⚠️
controllers/aso_credential_cache.go	86.11%	15 Missing and 5 partials ⚠️
main.go	0.00%	3 Missing ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #5211      +/-   ##
==========================================
+ Coverage   52.66%   52.99%   +0.33%     
==========================================
  Files         273      272       -1     
  Lines       29189    29427     +238     
==========================================
+ Hits        15371    15596     +225     
+ Misses      13029    13027       -2     
- Partials      789      804      +15     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

[mboersma]

/assign

[mboersma]

/lgtm

Makes sense to me, and the docs and tests are great. All I could find to comment on was a doc line. Happy to approve unless someone else is slated to review.

[k8s-ci-robot]

LGTM label has been added.

Git tree hash: 9b6d3e9d8446171a8549683aa17b83e3f8d9156e

[nojnhuh]

Only running this here to make sure #5272 really does break this test:
/test pull-cluster-api-provider-azure-windows-custom-builds

[nawazkh]

minor nit, non blocking
/lgtm

[k8s-ci-robot]

LGTM label has been added.

Git tree hash: 3a9411eff083f1ecc4c475f4367360e83e449236

[willie-yao]

/retest

[k8s-ci-robot]

@nojnhuh: The following test failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
pull-cluster-api-provider-azure-windows-custom-builds	5d79fc8	link	false	/test pull-cluster-api-provider-azure-windows-custom-builds

Full PR test history. Your PR dashboard. Please help us cut down on flakes by linking to an open issue when you hit one in your PR.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

[nojnhuh]

@mboersma @nawazkh Could I please get one final look at this? I think it's good to go now.

[mboersma]

/lgtm
/approve

[k8s-ci-robot]

LGTM label has been added.

Git tree hash: 4adc28e3d5987f284ef608f58e6647f86eee6a77

[k8s-ci-robot]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: mboersma

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

• OWNERS [mboersma]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment