Until now, you bring the Kladde to Azure with azd up from your machine. That's convenient, but it depends on you: on your sign-in,
your state of the files, your memory. In this lesson, the pipeline takes over the delivery. Every commit on main goes to dev by itself.
And the pipeline signs in to Azure while doing it, without a password, a client secret or a private
key being stored anywhere.
The problem with the secret
The classic way looked like this: you create an app registration in Entra ID, generate a client secret for it and store it as a secret in the repository. The pipeline signs in with it as that app. That works, but it has all the weaknesses of a stored key:
- It expires, usually after one to two years, and then the delivery stops, often on a Friday afternoon.
- Whoever knows it can sign in as the pipeline from anywhere, not just from the pipeline. A secret in a log, a screenshot or an old laptop is enough.
- There's no way to prove that nobody copied it.
The Kladde's house rules have said since module 3.3: where possible, there's no secret at all. For pipelines, it's possible.