/azure

name: azure
description: Azure identity (Workload Identity, OIDC, Entra ID), resource tagging, AKS platform patterns, RBAC scoping, and production-readiness review — with Terraform generation.
argument-hint: "[identity|tagging|aks|rbac|review] [description or Terraform snippet]"
title: "Azure Command"
sidebar_label: "azure"
custom_edit_url: null

Azure Command

Structured guidance for Azure identity, resource governance, AKS platform patterns, and production-readiness review.

Activation

/platform-skills:azure identity   # Workload Identity, OIDC federation, managed identities, Entra ID
/platform-skills:azure tagging    # common_tags pattern, Azure Policy enforce/remediate, AKS MC_ group
/platform-skills:azure aks        # AKS provisioning, add-ons, Flux/Argo bootstrap, node pools
/platform-skills:azure rbac       # role assignment scoping, custom roles, audit over-permissioned identities
/platform-skills:azure review     # production-readiness checklist for an Azure environment

---

Interactive Wizard (fires when no mode is provided)

When invoked with no arguments, ask before proceeding:

**Q1 — Mode?**

What do you need?
  1. identity  — Workload Identity, OIDC federation for GitHub Actions, managed identities, Entra ID
  2. tagging   — common_tags baseline, Azure Policy enforcement, MC_ resource group, cost analysis
  3. aks       — AKS cluster provisioning, node pools, workload identity, Flux/Argo bootstrap
  4. rbac      — role assignment scoping, custom roles, audit over-permissioned identities
  5. review    — production-readiness checklist (tagging, RBAC, OIDC, protected environments)

Enter 1–5 or mode name:

**Q2 — Context** (after mode selected):

• **identity**: `What needs Azure access — a GitHub Actions workflow, an in-cluster workload, or a human team?`
• **tagging**: `Paste your Terraform module or describe the resource types you need to tag.`
• **aks**: `New cluster or modifying existing? What add-ons are needed (Flux, Argo CD, ESO, Linkerd)?`
• **rbac**: `Describe the identity (user, group, managed identity) and what it needs to do.`
• **review**: `Describe the environment — how many subscriptions, which workloads, any compliance requirements?`

---

Mode: identity

**Triggers:** Workload Identity, OIDC, managed identity, service principal, federated credential, GitHub Actions Azure login, Entra ID

Read `references/azure.md` before responding.

GitHub Actions OIDC federation (no long-lived secrets)

# Create a user-assigned managed identity
az identity create \
  --name github-actions-deploy \
  --resource-group platform-rg \
  --location northeurope

# Get the identity's client ID
CLIENT_ID=$(az identity show \
  --name github-actions-deploy \
  --resource-group platform-rg \
  --query clientId -o tsv)

# Add a federated credential — scoped to a specific repo and branch
az identity federated-credential create \
  --name github-main-branch \
  --identity-name github-actions-deploy \
  --resource-group platform-rg \
  --issuer https://token.actions.githubusercontent.com \
  --subject repo:org/repo:ref:refs/heads/main \
  --audience api://AzureADTokenExchange

GitHub Actions workflow:

permissions:
  id-token: write
  contents: read

steps:
  - uses: azure/login@a65d910e8af852a8061c627c456678983e180302  # v2.2.0
    with:
      client-id: ${{ secrets.AZURE_CLIENT_ID }}
      tenant-id: ${{ secrets.AZURE_TENANT_ID }}
      subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID }}

AKS Workload Identity (in-cluster pods)

# Terraform — user-assigned managed identity for a workload
resource "azurerm_user_assigned_identity" "app" {
  name                = "app-workload-identity"
  resource_group_name = azurerm_resource_group.this.name
  location            = var.location
}

# Federated credential — links the Kubernetes service account to the managed identity
# Requires azurerm >= 5.0.0. On 4.x and earlier this resource took parent_id plus
# resource_group_name; 5.0.0 replaced both with user_assigned_identity_id.
resource "azurerm_federated_identity_credential" "app" {
  name                      = "app-k8s-sa"
  user_assigned_identity_id = azurerm_user_assigned_identity.app.id
  audience                  = ["api://AzureADTokenExchange"]
  issuer                    = azurerm_kubernetes_cluster.this.oidc_issuer_url
  subject                   = "system:serviceaccount:app-team:app-sa"
}

Kubernetes service account with workload identity annotation:

apiVersion: v1
kind: ServiceAccount
metadata:
  name: app-sa
  namespace: app-team
  annotations:
    azure.workload.identity/client-id: "<managed-identity-client-id>"

Pod label to opt in:

spec:
  template:
    metadata:
      labels:
        azure.workload.identity/use: "true"

Common identity mistakes

| Mistake | Fix | |---|---| | Using service principal secrets for GitHub Actions | Replace with OIDC federated credential | | Forgetting `azure.workload.identity/use: "true"` label on pods | Add the label to the pod template spec | | `subject` in federated credential does not match the SA namespace/name | `system:serviceaccount:<namespace>:<sa-name>` — must match exactly | | Identity scoped at subscription level for app workloads | Scope role assignment to the resource group or specific resource |

---

Mode: tagging

**Triggers:** tags, tagging, common_tags, Azure Policy, MC_, cost allocation, chargeback, compliance tags

Read `references/azure.md` → Tagging resources section before responding.

Shared locals pattern (Terraform)

# variables.tf
variable "common_tags" {
  description = "Baseline tags merged into every resource. Keys are defined by the organization."
  type        = map(string)
}

# locals.tf
locals {
  common_tags = var.common_tags
}

# Every resource uses merge — resource-level tags extend the baseline
resource "azurerm_kubernetes_cluster" "this" {
  name                = var.cluster_name
  locatio