{"record":{"id":"4c2e37e57f12281f","repo":"hashicorp/terraform","slug":"reading-oidc-token-from-file-q-provided-by-aks-wo","errorCode":null,"errorMessage":"reading OIDC Token from file %q provided by AKS Workload Identity: %v","messagePattern":"reading OIDC Token from file %q provided by AKS Workload Identity: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/backend/remote-state/azure/helpers.go","lineNumber":68,"sourceCode":"\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"reading OIDC Token from file %q: %v\", path, err)\n\t\t}\n\n\t\tfileToken := strings.TrimSpace(string(fileTokenRaw))\n\n\t\tif idToken != \"\" && idToken != fileToken {\n\t\t\treturn nil, fmt.Errorf(\"mismatch between supplied OIDC token and supplied OIDC token file contents - please either remove one or ensure they match\")\n\t\t}\n\n\t\tidToken = fileToken\n\t}\n\n\tif d.Bool(\"use_aks_workload_identity\") && os.Getenv(\"AZURE_FEDERATED_TOKEN_FILE\") != \"\" {\n\t\tpath := os.Getenv(\"AZURE_FEDERATED_TOKEN_FILE\")\n\t\tfileTokenRaw, err := os.ReadFile(os.Getenv(\"AZURE_FEDERATED_TOKEN_FILE\"))\n\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"reading OIDC Token from file %q provided by AKS Workload Identity: %v\", path, err)\n\t\t}\n\n\t\tfileToken := strings.TrimSpace(string(fileTokenRaw))\n\n\t\tif idToken != \"\" && idToken != fileToken {\n\t\t\treturn nil, fmt.Errorf(\"mismatch between supplied OIDC token and OIDC token file contents provided by AKS Workload Identity - please either remove one, ensure they match, or disable use_aks_workload_identity\")\n\t\t}\n\n\t\tidToken = fileToken\n\t}\n\n\treturn &idToken, nil\n}\n\nfunc getClientId(d *backendbase.SDKLikeData) (*string, error) {\n\tclientId := strings.TrimSpace(d.String(\"client_id\"))\n\n\tif path := d.String(\"client_id_file_path\"); path != \"\" {","sourceCodeStart":50,"sourceCodeEnd":86,"githubUrl":"https://github.com/hashicorp/terraform/blob/c9def3e214014c1188faabfc4a5bde5095139765/internal/backend/remote-state/azure/helpers.go#L50-L86","documentation":"When `use_aks_workload_identity=true` and the `AZURE_FEDERATED_TOKEN_FILE` env var is set, getOidcToken (helpers.go:68) reads the projected service-account token from that file. If os.ReadFile fails, the underlying error is wrapped with the AKS Workload Identity context.","triggerScenarios":"Running in an AKS pod with use_aks_workload_identity enabled but the projected token file at $AZURE_FEDERATED_TOKEN_FILE is missing, unreadable, or the env var points at a path that was never mounted by the workload-identity webhook.","commonSituations":"The Azure AD Workload Identity mutating webhook did not inject the volume/env var; service account not annotated with the right client ID; pod restarted on a node where the projected volume path differs; insufficient file permissions.","solutions":["Confirm AZURE_FEDERATED_TOKEN_FILE is set and the path is readable: `test -r \"$AZURE_FEDERATED_TOKEN_FILE\"`.","Ensure the pod's service account is annotated with azure.workload.identity/client-id and the webhook is enabled.","Verify the ServiceAccount, the workload-identity label, and the federated identity credential exist in Azure.","If not actually on AKS, disable use_aks_workload_identity."],"exampleFix":"# before: workload-identity webhook not injecting the volume\n# after: annotate the ServiceAccount used by the pod\napiVersion: v1\nkind: ServiceAccount\nmetadata:\n  name: tf-runner\n  annotations:\n    azure.workload.identity/client-id: 00000000-0000-0000-0000-000000000000\n  labels:\n    azure.workload.identity/use: \"true\"","handlingStrategy":"validation","validationCode":"# when use_aks_workload_identity=true the federated token file must be readable\nif [ \"${TF_VAR_use_aks_workload_identity:-false}\" = \"true\" ]; then\n  f=\"${AZURE_FEDERATED_TOKEN_FILE:?AZURE_FEDERATED_TOKEN_FILE not set}\"\n  test -r \"$f\" || { echo \"federated token file not readable: $f\" >&2; exit 1; }\nfi","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Confirm the AKS workload-identity webhook injected the env var and volume.","Keep the Azure AD Workload Identity addon up to date.","Verify the service account annotation and federated credential before deploying."],"tags":["azure","oidc","aks","workload-identity","file-io"],"analyzedSha":"c9def3e214014c1188faabfc4a5bde5095139765","analyzedAt":"2026-08-07T15:39:49.278Z","schemaVersion":2},"datasetVersion":"2026-08-07T21:17:07.882Z"}