[RFC-0007] Enable Azure OIDC for Azure DevOps Repository

[dipti-pai]

• Controller changes to set the provider options in git authOptions to fetch provider credentials while building git config if .spec.provider field is set to azure.

• API docs for setting up Azure workload identity in IAC

• Unit tests for testing provider settings in git config

[darkowlzz]

Overall, the implementation looks good to me.
Left a few suggestions for the docs.

I tested this in an AKS cluster, similar to the manual testing of source-controller against Azure DevOps and got similar results (the results below are not in order):

Without setting the provider on the associated GitRepo, IUA fails with the following status:

status:
  conditions:
  - lastTransitionTime: "2024-09-16T13:20:54Z"
    message: reconciliation in progress
    observedGeneration: 1
    reason: ProgressingWithRetry
    status: "True"
    type: Reconciling
  - lastTransitionTime: "2024-09-16T13:20:54Z"
    message: 'failed to checkout source: unable to list remote for ''https://dev.azure.com/test-org/fluxProjinowombat/_git/fluxRepoinowombat'':
      authentication required'
    observedGeneration: 1
    reason: GitOperationFailed
    status: "False"
    type: Ready
  lastAutomationRunTime: "2024-09-16T13:20:59Z"
  lastPushCommit: 8667f22eb70c7d888b2b4f75008fe77f758dab64
  lastPushTime: "2024-09-16T13:20:53Z"
  observedGeneration: 1
  observedPolicies:
    podinfo:
      name: ghcr.io/stefanprodan/podinfo
      tag: 4.0.6
  observedSourceRevision: main@sha1:8667f22eb70c7d888b2b4f75008fe77f758dab64

With provider set as azure but removed access of the identity from the repo results in the following failure:

status:
  conditions:
  - lastTransitionTime: "2024-09-16T13:23:32Z"
    message: reconciliation in progress
    observedGeneration: 1
    reason: ProgressingWithRetry
    status: "True"
    type: Reconciling
  - lastTransitionTime: "2024-09-16T13:23:32Z"
    message: 'failed to checkout source: unable to clone: repository not found: git
      repository: ''https://dev.azure.com/test-org/fluxProjinowombat/_git/fluxRepoinowombat'''
    observedGeneration: 1
    reason: GitOperationFailed
    status: "False"
    type: Ready
  lastAutomationRunTime: "2024-09-16T13:23:35Z"
  lastPushCommit: 8667f22eb70c7d888b2b4f75008fe77f758dab64
  lastPushTime: "2024-09-16T13:20:53Z"
  observedGeneration: 1
  observedPolicies:
    podinfo:
      name: ghcr.io/stefanprodan/podinfo
      tag: 4.0.6
  observedSourceRevision: main@sha1:8667f22eb70c7d888b2b4f75008fe77f758dab64

With proper permission, it succeeds:

status:
  conditions:
  - lastTransitionTime: "2024-09-16T13:18:14Z"
    message: repository up-to-date
    observedGeneration: 1
    reason: Succeeded
    status: "True"
    type: Ready
  lastAutomationRunTime: "2024-09-16T13:19:06Z"
  lastPushCommit: a44ad49f985328762dd518496ba9670bd3143fd0
  lastPushTime: "2024-09-16T13:19:11Z"
  observedGeneration: 1
  observedPolicies:
    podinfo:
      name: ghcr.io/stefanprodan/podinfo
      tag: 5.1.4
  observedSourceRevision: main@sha1:a44ad49f985328762dd518496ba9670bd3143fd0

Everything looks as expected.

A screenshot of the commit list to show that it actually was able to push, regardless of what the status shows

[stefanprodan]

LGTM

Thanks @dipti-pai 🏅