Revisit external-dns authentication on Azure

[mcharriere]

Currently, external-dns is using the host azure.json file to authenticate against the Azure API, both on Vintage and CAPZ clusters.

We need to consider other options to avoid excessive privileges.

Also, we need to figure out why hostNetwork is needed and if this can be avoided using AzurePodIdentityException

Ref: https://gigantic.slack.com/archives/CLPMFRVU6/p1707208578052759
Details about current status of Identity Management on CAPZ

[mcharriere]

See https://github.com/giantswarm/giantswarm/issues/33582

[weatherhog]

@mcharriere can this issue be closed?

[mcharriere]

No, AFAIK we can proceed with this now

[mcharriere]

I've sketched a PR switching to WorkloadIdentities. The thing is that the external-dns-crossplane-resources app has to be included in a new release, so it might take a while.

[mcharriere]

my tests are failing with:

external-dns-6d5c9fd89c-grmnk external-dns time="2026-07-23T19:19:44Z" level=fatal msg="Failed to do run once: WorkloadIdentityCredential authentication failed. \nPOST https://login.microsoftonline.com/..../oauth2/v2.0/token\n--------------------------------------------------------------------------------\nRESPONSE 401: 401 Unauthorized\n--------------------------------------------------------------------------------\n{\n  \"error\": \"invalid_client\",\n  \"error_description\": \"AADSTS70025: The client '....'(mati03-external-dns-7s85h) has no configured federated identity credentials. Trace ID: ... Correlation ID: ... Timestamp: 2026-07-23 19:19:44Z\",\n  \"error_codes\": [\n    70025\n  ],\n  \"timestamp\": \"2026-07-23 19:19:44Z\",\n  \"trace_id\": \"....\",\n  \"correlation_id\": \"....\"\n}\n--------------------------------------------------------------------------------\nTo troubleshoot, visit https://aka.ms/azsdk/go/identity/troubleshoot#workload"