azure devops calling rest api using workload identity

In this setup we are  trying to call Azure Devops endpoint to files in a repository or get a file content using REST API without using a PAT token. Instead we are fully relying on using workload identity and use Bear authorization. Let's see how we can do that. 

Before starting we need to ensure 

1. your pod is running on a specific managed identity (workload identity)

2. you have granted permission for this managed identity to access your Azure Devops  repositories / project

$AzureDevopsApplicationId = "499b84ac-1321-427f-aa17-267ca6975798"

# we are using az cli to get us the acces token

$token = az account get-access-token --resource $AzureDevopsApplicationId | ConvertFrom-Json

$headers = SetupAuthorizationHeader $token.accessToken

function SetupAuthorizationHeader($usertoken)

{        

  Write-Host("SetupAuthorizationHeader function/module")

  Write-Host($usertoken)

  $headers = New-Object "System.Collections.Generic.Dictionary[[String],[String]]"

  $headers.Add("Authorization", "Bearer $usertoken")

  $headers.Add("Content-Type", "application/json")

  return $headers

}

So we are using az cli to get the require token. 

Next, under setup AuthorizationHeader method, we are using that token to setup Bear authorization header which we will pass along in our requests.