Feature: Support Azure Workload Identity Federation (STS/keyless) for OpenShift/ARO clusters

[kaovilai]

Feature request

Add support for Azure Workload Identity Federation (STS/keyless/federated credentials) for OpenShift/ARO clusters in ocpctl. Currently, the platform uses service principal credentials for Azure authentication. Many enterprises require short-lived, keyless auth using federation/OIDC (similar to AWS STS or GCP WIF), especially in least-privilege or cloud-native automation environments.

Current behavior

• Azure authentication for OpenShift/ARO clusters relies on static client secret/service principal.
• No automated workflow for Azure AD Workload Identity Federation/federated OIDC.

Desired behavior

• Enable creating OpenShift/ARO clusters using Azure Workload Identity Federation (OIDC/federated credentials) instead of service principal client secrets.
• Support relevant install-config.yaml/cluster API fields for federated auth.
• Document the required Azure AD application setup, federated credential configuration, and cluster bootstrap flow.
• Provide parity with AWS (STS, IRSA) and planned GCP WIF.

References

• https://learn.microsoft.com/en-us/azure/active-directory/develop/workload-identity-federation
• https://cloud.redhat.com/blog/azure-workload-identity-for-openshift
• https://docs.openshift.com/container-platform/latest/authentication/managing_cloud_provider_credentials/cco-mode-manual.html
• https://docs.openshift.com/container-platform/latest/installing/installing_azure/installing-azure-customizations.html#installation-azure-wif-federation

Impact

This enables more secure, keyless automation, easier credential rotation, and a consistent experience with AWS/GCP clusters.