Refactor Devops Service Connection for ARM and ACR to support all authentication_scheme#195
Merged
SazniMohamed merged 4 commits intowso2:mainfrom Mar 19, 2026
Merged
Conversation
…tion and ServicePrincipal
…tion and ServicePrincipal
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (2)
✅ Files skipped from review due to trivial changes (1)
WalkthroughACR and ARM Azure DevOps service endpoint modules now accept a configurable Changes
Estimated code review effort🎯 3 (Moderate) | ⏱️ ~20 minutes Poem
🚥 Pre-merge checks | ✅ 2 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (2 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
📝 Coding Plan
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (1)
modules/azuredevops/ARM-Service-Endpoint/variables.tf (1)
45-48:⚠️ Potential issue | 🟡 MinorTypo in description: "if" should be "of".
📝 Proposed fix
variable "tenant_id" { - description = "The Tenant ID if the service principal." + description = "The Tenant ID of the service principal." type = string }🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@modules/azuredevops/ARM-Service-Endpoint/variables.tf` around lines 45 - 48, Fix the typo in the tenant_id variable description: change the string in the variable declaration for tenant_id (variable "tenant_id") from "The Tenant ID if the service principal." to "The Tenant ID of the service principal." so the description reads correctly; update only the description value in the variable block and keep the variable name and type unchanged.
🧹 Nitpick comments (2)
modules/azuredevops/ARM-Service-Endpoint/variables.tf (1)
60-64: Add validation forauthentication_schemeto catch invalid values early.Without validation, invalid values will only error at apply time. Constraining input improves usability.
✅ Proposed fix
variable "authentication_scheme" { description = "The authentication scheme to use for the service endpoint. Possible values are WorkloadIdentityFederation, ManagedServiceIdentity or ServicePrincipal." type = string default = "ServicePrincipal" + + validation { + condition = contains(["WorkloadIdentityFederation", "ManagedServiceIdentity", "ServicePrincipal"], var.authentication_scheme) + error_message = "authentication_scheme must be one of: WorkloadIdentityFederation, ManagedServiceIdentity, ServicePrincipal." + } }🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@modules/azuredevops/ARM-Service-Endpoint/variables.tf` around lines 60 - 64, Add a Terraform validation block to the variable "authentication_scheme" to reject values other than the allowed set (WorkloadIdentityFederation, ManagedServiceIdentity, ServicePrincipal); implement this by adding a validation { condition = contains([...], var.authentication_scheme) error_message = "..." } for the authentication_scheme variable so invalid inputs fail during plan/validation instead of apply.modules/azuredevops/ACR-Service-Endpoint/variables.tf (1)
52-56: Add validation forauthentication_schemeto catch invalid values early.Same recommendation as the ARM module for consistency and early error detection.
✅ Proposed fix
variable "authentication_scheme" { description = "The authentication scheme to use for the service endpoint. Possible values are WorkloadIdentityFederation, ManagedServiceIdentity or ServicePrincipal." type = string default = "ServicePrincipal" + + validation { + condition = contains(["WorkloadIdentityFederation", "ManagedServiceIdentity", "ServicePrincipal"], var.authentication_scheme) + error_message = "authentication_scheme must be one of: WorkloadIdentityFederation, ManagedServiceIdentity, ServicePrincipal." + } }🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@modules/azuredevops/ACR-Service-Endpoint/variables.tf` around lines 52 - 56, The variable "authentication_scheme" lacks input validation; add a Terraform validation block for variable "authentication_scheme" that enforces allowed values ["WorkloadIdentityFederation", "ManagedServiceIdentity", "ServicePrincipal"] and provide a clear error_message indicating the permitted options so invalid values are rejected early (keep the variable name and type as-is and add the validation stanza to the variable block).
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In `@modules/azuredevops/ACR-Service-Endpoint/acr_service_endpoint.tf`:
- Around line 23-28: The dynamic "credentials" block is gated only by
var.service_principal_id and can be emitted even when authentication is not
service principal; update the for_each condition to also check the chosen
var.authentication_scheme (e.g., only render credentials when
var.authentication_scheme indicates a ServicePrincipal flow) and keep the
existing serviceprincipalid content; reference the dynamic "credentials" block,
var.service_principal_id, and var.authentication_scheme when making the change
so the credentials block is produced only for the proper authentication_scheme.
In `@modules/azuredevops/ARM-Service-Endpoint/variables.tf`:
- Around line 33-43: The Terraform variables service_principal_key and
service_principal_certificate are secrets and must be marked sensitive; update
the variable blocks for service_principal_key and service_principal_certificate
(the variable declarations with those exact names) to include sensitive = true
so their values are redacted in logs/CLI output while keeping the existing
description, type, and default handling.
---
Outside diff comments:
In `@modules/azuredevops/ARM-Service-Endpoint/variables.tf`:
- Around line 45-48: Fix the typo in the tenant_id variable description: change
the string in the variable declaration for tenant_id (variable "tenant_id") from
"The Tenant ID if the service principal." to "The Tenant ID of the service
principal." so the description reads correctly; update only the description
value in the variable block and keep the variable name and type unchanged.
---
Nitpick comments:
In `@modules/azuredevops/ACR-Service-Endpoint/variables.tf`:
- Around line 52-56: The variable "authentication_scheme" lacks input
validation; add a Terraform validation block for variable
"authentication_scheme" that enforces allowed values
["WorkloadIdentityFederation", "ManagedServiceIdentity", "ServicePrincipal"] and
provide a clear error_message indicating the permitted options so invalid values
are rejected early (keep the variable name and type as-is and add the validation
stanza to the variable block).
In `@modules/azuredevops/ARM-Service-Endpoint/variables.tf`:
- Around line 60-64: Add a Terraform validation block to the variable
"authentication_scheme" to reject values other than the allowed set
(WorkloadIdentityFederation, ManagedServiceIdentity, ServicePrincipal);
implement this by adding a validation { condition = contains([...],
var.authentication_scheme) error_message = "..." } for the authentication_scheme
variable so invalid inputs fail during plan/validation instead of apply.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro
Run ID: 92a994c3-e170-4fa0-b75e-8bb14432dc71
📒 Files selected for processing (4)
modules/azuredevops/ACR-Service-Endpoint/acr_service_endpoint.tfmodules/azuredevops/ACR-Service-Endpoint/variables.tfmodules/azuredevops/ARM-Service-Endpoint/arm_service_endpoint.tfmodules/azuredevops/ARM-Service-Endpoint/variables.tf
There was a problem hiding this comment.
🧹 Nitpick comments (1)
modules/azuredevops/ARM-Service-Endpoint/variables.tf (1)
62-66: Add enum validation forauthentication_schemeto fail fast.Currently the variable accepts any string, with invalid values failing only at apply time. Adding validation will constrain the input to the three accepted schemes and catch errors earlier.
♻️ Proposed change
variable "authentication_scheme" { description = "The authentication scheme to use for the service endpoint. Possible values are WorkloadIdentityFederation, ManagedServiceIdentity or ServicePrincipal." type = string default = "ServicePrincipal" + validation { + condition = contains( + ["ServicePrincipal", "WorkloadIdentityFederation", "ManagedServiceIdentity"], + var.authentication_scheme + ) + error_message = "authentication_scheme must be one of: ServicePrincipal, WorkloadIdentityFederation, ManagedServiceIdentity." + } }🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@modules/azuredevops/ARM-Service-Endpoint/variables.tf` around lines 62 - 66, The variable "authentication_scheme" currently allows any string; add a Terraform validation block to the variable to restrict values to the accepted enum {"WorkloadIdentityFederation", "ManagedServiceIdentity", "ServicePrincipal"} so invalid values fail at plan time; specifically, inside the variable "authentication_scheme" block add validation { condition = contains(["WorkloadIdentityFederation","ManagedServiceIdentity","ServicePrincipal"], var.authentication_scheme) error_message = "authentication_scheme must be one of: WorkloadIdentityFederation, ManagedServiceIdentity, ServicePrincipal" } to enforce the allowed options.
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Nitpick comments:
In `@modules/azuredevops/ARM-Service-Endpoint/variables.tf`:
- Around line 62-66: The variable "authentication_scheme" currently allows any
string; add a Terraform validation block to the variable to restrict values to
the accepted enum {"WorkloadIdentityFederation", "ManagedServiceIdentity",
"ServicePrincipal"} so invalid values fail at plan time; specifically, inside
the variable "authentication_scheme" block add validation { condition =
contains(["WorkloadIdentityFederation","ManagedServiceIdentity","ServicePrincipal"],
var.authentication_scheme) error_message = "authentication_scheme must be one
of: WorkloadIdentityFederation, ManagedServiceIdentity, ServicePrincipal" } to
enforce the allowed options.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro
Run ID: 6b255516-e05d-44fe-9d7b-b92f47226f75
📒 Files selected for processing (1)
modules/azuredevops/ARM-Service-Endpoint/variables.tf
Migara-Pramod
approved these changes
Mar 19, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Purpose
This pull request enhances the Azure DevOps Service Endpoint modules by introducing flexible authentication methods. It enables support for Workload Identity Federation and Certificate-based authentication, moving away from a strict requirement for Service Principal secrets.
Authentication Improvements
Configurable Authentication Schemes: Added support for service_endpoint_authentication_scheme across ACR and ARM service endpoints, allowing users to toggle between ServicePrincipal and WorkloadIdentityFederation.
Certificate Support: Expanded the ARM Service Endpoint resource to support service_principal_certificate as an alternative to standard password-based authentication.
Credential Flexibility: Refactored the credentials block into a dynamic configuration. This makes service_principal_key optional and ensures it is only required when the authentication scheme necessitates it.
Summary by CodeRabbit
Summary by CodeRabbit