Use ServiceAccount for Workload Identity clientID and tenantId

[dkirrane]

Feature Request
Currently for Workload Identity the SecretProviderClass requires clientID and tenantId.
However this detail is already available from the application's ServiceAccount

apiVersion: v1
kind: ServiceAccount
metadata:
  name: my-app
  namespace: default
  labels:
    azure.workload.identity/use: 'true'
  annotations:
    azure.workload.identity/client-id: XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
    azure.workload.identity/tenant-id: ZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZ

apiVersion: secrets-store.csi.x-k8s.io/v1
kind: SecretProviderClass
metadata:
  name: my-app
spec:
  provider: azure
  parameters:
    usePodIdentity: "false"
    clientID: XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
    keyvaultName: my-kv
    tenantId: ZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZ

Proposal

Instead can the SecretProviderClass just use the ServiceAccount for clientID and tenantId?
for example

apiVersion: secrets-store.csi.x-k8s.io/v1
kind: SecretProviderClass
metadata:
  name: my-app
spec:
  provider: azure
  parameters:
    usePodIdentity: "false"
    serviceAccountName: my-app
    keyvaultName: my-kv

[rbtz-openai]

@aramase Can we bump the priority for this, or should we go through Azure Support to escalate?

[wenzel-felix]

#1443 I just opened this PR trying to adjust it similarly to your request.
Currently, it only takes care of the clientID, not the tenantID as the latter one is theoretically optional for the service account. I don't see it as big of an issue as the clientID, which potentially changes for every SPC. The tenantID is rather static.