[RFC-0010] Add multi-tenant workload identity support for Azure GitRepository

[dipti-pai]

Part of: fluxcd/flux2#5022

Changes include :

• Add .spec.serviceAccountName field to GitRepository
• Controller changes to set the service account to use object-level workload identity
• Docs and unit tests

Test Behavior

1. Feature gate disabled

  status:
    conditions:
    - lastTransitionTime: "2025-08-14T23:26:40Z"
      message: to use spec.serviceAccountName for provider authentication please enable
        the ObjectLevelWorkloadIdentity feature gate in the controller
      observedGeneration: 5
      reason: FeatureGateDisabled
      status: "True"
      type: Stalled
    - lastTransitionTime: "2025-08-14T23:26:40Z"
      message: to use spec.serviceAccountName for provider authentication please enable
        the ObjectLevelWorkloadIdentity feature gate in the controller
      observedGeneration: 5
      reason: FeatureGateDisabled
      status: "False"
      type: Ready
    - lastTransitionTime: "2025-08-14T23:26:40Z"
      message: to use spec.serviceAccountName for provider authentication please enable
        the ObjectLevelWorkloadIdentity feature gate in the controller
      observedGeneration: 5
      reason: FeatureGateDisabled
      status: "True"
      type: FetchFailed
    lastHandledReconcileAt: "2025-08-08T00:32:04.177906951Z"
    observedGeneration: 5

2. Controller does not have permissions to create access tokens

    - lastTransitionTime: "2025-08-14T22:41:41Z"
      message: 'failed to configure authentication options: failed to create kubernetes
        token for service account ''adoconfig/az-mi-user'': serviceaccounts "az-mi-user"
        is forbidden: User "system:serviceaccount:flux-system:source-controller" cannot
        create resource "serviceaccounts/token" in API group "" in the namespace "adoconfig"'

To fix this, the clusterrole should have the following access.

- apiGroups:
  - ""
  resources:
  - serviceaccounts/token
  verbs:
  - create

3. Success case

  status:
    artifact:
    - lastTransitionTime: "2025-08-14T23:29:09Z"
      message: stored artifact for revision 'main@sha1:b7d5a1fa643e65b98a11828ddc1de47b61fba654'
      observedGeneration: 5
      reason: Succeeded
      status: "True"
      type: ArtifactInStorage
    lastHandledReconcileAt: "2025-08-08T00:32:04.177906951Z"
    observedGeneration: 5

[matheuscscp]

Looking good! Thanks, @dipti-pai!

[matheuscscp]

LGTM! 🚀

Thanks very much, @dipti-pai!