Azure kubelogin, A Kubeconfig Converted Offline

kubelogin

Azure kubelogin on EL 10 from the vendor's release, checked against the published SHA-256, pinned to a version, installed as root's binary in /usr/local/bin. Original role for EL 10, live-tested with podman on Rocky Linux 10.

No package worth the name. EL 10 carries no kubelogin, and a third-party repository is one more key to trust. This role takes the release from azure.github.io/kubelogin, has Ansible's get_url refuse the asset unless its SHA-256 is the published one, and the live test checks the asset on disk against the same published value again.

Pinned. kubelogin_version is what gets installed, kept in a directory of its own so the checksum file and the asset it names stay together. A newer release is a variable change and a run; the same version is changed=0.

Proven to run. The live test runs kubelogin get-token -l azurecli --server-id 6dae42f8-4368-4678-94ff-3960e28e3630 and expects "AzureCLICredential: executable not found on path" - the binary ran all the way to the point where it needed something this host does not have.

A kubeconfig converted, offline. The live test writes a kubeconfig in the shape az aks get-credentials produced before the in-tree azure auth-provider was removed from kubectl, has kubelogin convert-kubeconfig -l azurecli rewrite it, and asserts the user now runs kubelogin get-token --login azurecli and the auth-provider block is gone. Then get-token itself runs until it needs the Azure CLI, which this host does not have ("AzureCLICredential: executable not found on path"). The release publishes one .sha256 per asset, which this role checks; the zip holds bin/linux_<arch>/kubelogin.

License

Commercial - IaC Bazaar EULA. (c) IaC Bazaar.