hashicorp/terraform · error

reading OIDC Token from file %q provided by AKS Workload Ide

Error message

reading OIDC Token from file %q provided by AKS Workload Identity: %v

What it means

When `use_aks_workload_identity=true` and the `AZURE_FEDERATED_TOKEN_FILE` env var is set, getOidcToken (helpers.go:68) reads the projected service-account token from that file. If os.ReadFile fails, the underlying error is wrapped with the AKS Workload Identity context.

Source

Thrown at internal/backend/remote-state/azure/helpers.go:68

		if err != nil {
			return nil, fmt.Errorf("reading OIDC Token from file %q: %v", path, err)
		}

		fileToken := strings.TrimSpace(string(fileTokenRaw))

		if idToken != "" && idToken != fileToken {
			return nil, fmt.Errorf("mismatch between supplied OIDC token and supplied OIDC token file contents - please either remove one or ensure they match")
		}

		idToken = fileToken
	}

	if d.Bool("use_aks_workload_identity") && os.Getenv("AZURE_FEDERATED_TOKEN_FILE") != "" {
		path := os.Getenv("AZURE_FEDERATED_TOKEN_FILE")
		fileTokenRaw, err := os.ReadFile(os.Getenv("AZURE_FEDERATED_TOKEN_FILE"))

		if err != nil {
			return nil, fmt.Errorf("reading OIDC Token from file %q provided by AKS Workload Identity: %v", path, err)
		}

		fileToken := strings.TrimSpace(string(fileTokenRaw))

		if idToken != "" && idToken != fileToken {
			return nil, fmt.Errorf("mismatch between supplied OIDC token and OIDC token file contents provided by AKS Workload Identity - please either remove one, ensure they match, or disable use_aks_workload_identity")
		}

		idToken = fileToken
	}

	return &idToken, nil
}

func getClientId(d *backendbase.SDKLikeData) (*string, error) {
	clientId := strings.TrimSpace(d.String("client_id"))

	if path := d.String("client_id_file_path"); path != "" {

View on GitHub (pinned to c9def3e214)

Solutions

1. Confirm AZURE_FEDERATED_TOKEN_FILE is set and the path is readable: `test -r "$AZURE_FEDERATED_TOKEN_FILE"`.
2. Ensure the pod's service account is annotated with azure.workload.identity/client-id and the webhook is enabled.
3. Verify the ServiceAccount, the workload-identity label, and the federated identity credential exist in Azure.
4. If not actually on AKS, disable use_aks_workload_identity.

Example fix

# before: workload-identity webhook not injecting the volume
# after: annotate the ServiceAccount used by the pod
apiVersion: v1
kind: ServiceAccount
metadata:
  name: tf-runner
  annotations:
    azure.workload.identity/client-id: 00000000-0000-0000-0000-000000000000
  labels:
    azure.workload.identity/use: "true"

# when use_aks_workload_identity=true the federated token file must be readable
if [ "${TF_VAR_use_aks_workload_identity:-false}" = "true" ]; then
  f="${AZURE_FEDERATED_TOKEN_FILE:?AZURE_FEDERATED_TOKEN_FILE not set}"
  test -r "$f" || { echo "federated token file not readable: $f" >&2; exit 1; }
fi

When it happens

Trigger: Running in an AKS pod with use_aks_workload_identity enabled but the projected token file at $AZURE_FEDERATED_TOKEN_FILE is missing, unreadable, or the env var points at a path that was never mounted by the workload-identity webhook.

Common situations: The Azure AD Workload Identity mutating webhook did not inject the volume/env var; service account not annotated with the right client ID; pod restarted on a node where the projected volume path differs; insufficient file permissions.

Related errors

• mismatch between supplied OIDC token and OIDC token file con
• reading OIDC Token from file %q: %v
• mismatch between supplied Client ID and that provided by AKS
• mismatch between supplied Tenant ID and that provided by AKS
• mismatch between supplied OIDC token and supplied OIDC token

AI-assisted analysis of hashicorp/terraform@c9def3e214 (2026-08-07). Data as JSON: /api/errors/4c2e37e57f12281f. Report an issue: GitHub.