Azure Key Vault plugin on Jenkins throws ManagedIdentityCredential authentication unavailable.Connection to IMDS endpoint cannot be established

Using Jenkins
1

Jenkins setup:
Jenkins is installed on Kubernetes Cluster via Helm chart.
Jenkins Version: 2.414.2
Issue with: Azure Key Vault Plugin
Plugin Version: 214.vf667264ea_ccd

Hi Team,

We recently installed Azure Key Vault plugin on our Jenkins and configured with Azure Managed identity credentials. We followed this documentation Azure Key Vault | Jenkins plugin

Configured in Jenkins pipeline like below:

 def test() 
{
azureKeyVault([[envVariable: 'test-creds', name: 'test-creds', secretType: 'secret']])
}

Facing the below error:

com.azure.identity.CredentialUnavailableException: ManagedIdentityCredential authentication unavailable. Connection to IMDS endpoint cannot be established.
at com.azure.identity.implementation.IdentityClient.lambda$authenticateToIMDSEndpoint$53(IdentityClient.java:1105)
at reactor.core.publisher.MonoCallable.call(MonoCallable.java:92)
at reactor.core.publisher.FluxFlatMap.trySubscribeScalarMap(FluxFlatMap.java:174)
at reactor.core.publisher.MonoFlatMap.subscribeOrReturn(MonoFlatMap.java:53)
at reactor.core.publisher.Mono.subscribe(Mono.java:4475)
at reactor.core.publisher.Mono.subscribeWith(Mono.java:4605)
at reactor.core.publisher.Mono.toFuture(Mono.java:5010)
at com.azure.identity.implementation.IdentityClientBase.lambda$getManagedIdentityConfidentialClient$1(IdentityClientBase.java:341)
at com.microsoft.aad.msal4j.AcquireTokenByAppProviderSupplier.fetchTokenUsingAppTokenProvider(AcquireTokenByAppProviderSupplier.java:66)

Kindly let me know what is that i am doing wrong.

Thanks

2

Hello @tech_savy and welcome to this community. :wave:

It looks like the Azure Managed Identity for your Jenkins instance is having trouble authenticating or connecting to the Azure IMDS (Instance Metadata Service) endpoint.

Are you sure that the Azure Managed Identity you’ve configured in Jenkins has the appropriate permissions to access the Azure Key Vault? :thinking:
I think it should have at least the “get” permission on secrets.

3

Dear @poddingue
Thank you for your reply !

Yes , the Managed identity has both Get and List permission on Key Vault secrets. Do we also need it on Key Vault level?

Thanks

1 Like