fix: unblock flux ACR login on self-hosted runners - #706
Merged
Conversation
Publish Syncroot artifacts failed on the self-hosted runners with: error during login with provider: failed to create provider access token for the controller: DefaultAzureCredential: failed to acquire a token ... ManagedIdentityCredential authentication failed RESPONSE 400: Unable to load the proper Managed Identity The self-hosted runners are Azure Container App Jobs, which inject a managed identity endpoint. flux --provider=azure uses the Azure SDK's DefaultAzureCredential, which walks a fixed chain of credentials. On GitHub-hosted runners there is no managed identity endpoint, so ManagedIdentityCredential reports itself unavailable and the chain falls through to AzureCLICredential, which picks up the session established by azure/login. On Container Apps the endpoint exists, so it is attempted, and because the job has a user-assigned identity and flux passes no client id, the endpoint returns HTTP 400. The SDK treats that as a hard authentication failure and aborts the chain, so the az login session is never reached. Clearing the two endpoint variables for this job makes ManagedIdentityCredential report unavailable again, restoring the same code path GitHub-hosted runners take. Verified by reproducing both chains against flux 2.6.4 in the runner image: with the endpoint present the chain stops at ManagedIdentityCredential, and with it cleared the chain reaches AzureCLICredential. This is a workaround in one repository. The durable fix belongs in Altinn/altinn-platform's flux/build-push-image action, so that flux authenticates explicitly rather than by discovery, and is being proposed separately. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
alvlia
approved these changes
Aug 20, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes the ACR login failure that Publish Syncroot artifacts hit after moving to self-hosted runners in #695.
Why it happened
flux --provider=azureuses the Azure SDK'sDefaultAzureCredential, which walks a fixed chain and stops at the first hard failure.ManagedIdentityCredentialreports unavailable → chain continues →AzureCLICredentialpicks up theazure/loginsession ✅ManagedIdentityCredentialis attempted → job has a user-assigned identity and flux passes no client id → HTTP 400 → SDK treats it as a hard failure and aborts the chain beforeAzureCLICredential❌So
azure/loginsucceeds, and its session is then never consulted.Worth noting the runner's user-assigned identity has no role assignments either, so it could not push to
altinncreven if flux had selected it correctly.The fix
Clearing the two endpoint variables for this job makes
ManagedIdentityCredentialreport itself unavailable again, restoring exactly the code path GitHub-hosted runners take:Verification
Reproduced both chains against flux 2.6.4 inside the
gh-runner:v0.10.0image, using a mock endpoint returning the same 400:The
az loginerror in the second case is expected locally — there's no Azure session in my container. On the runnerazure/loginhas already established one, which is the whole point.Scope
This is a workaround in one repo. The durable fix belongs in
Altinn/altinn-platform'sflux/build-push-image, so flux authenticates explicitly instead of by discovery — proposed separately, since this will hit any team that moves a flux workflow onto these runners.🤖 Generated with Claude Code