Document Azure auth precedence

[jaellio]

Depending on how a user configures AgentgatewayBackend, there is an explicit and implicit precedence for selecting the method of acquiring Azure credentials. This precedence flow documented in this issues was determined based on authentication with Azure AI Foundry and Azure OpenAI, but could apply to other use cases.

1. Explicit auth config: spec.policies.auth
   • auth.key/auth.secretRef: secret containing an API key
   • auth.azure.secretRef: references a user defined secret referencing an Azure service principle. Reads clientID, tenantID and clientSecret from the Secret
   • auth.azure.managedIdentity: specific user assigned identity (cliendID/objectID/resourceID)
2. Implicit auth config: nothing set in spec.policies.auth. Sources are tried in order (see build_credential() in azure.rs)
   • EnvironmentCredential: service principle, if AZURE_TENANT_ID, AZURE_CLIENT_ID, and AZURE_CLIENT_SECRET` are all set
   • WorkloadIdentityCredential: Kubernetes workload identity, via AZURE_FEDERATED_TOKEN_FILE, AZURE_TENANT_ID, and AZURE_CLIENT_ID
   • ManagedIdentityCredential: Azure VM IMDS / App Service. User‑assigned selectable via AZURE_CLIENT_ID. Guarded by a 1‑second TCP probe to 169.254.169.254:80; if IMDS is unreachable it's skipped to avoid the SDK's ~99 s retry loop (unless IDENTITY_ENDPOINT/MSI_ENDPOINT are set, which skips the probe)
   • DeveloperToolsCredential: az login / azd auth login, for local dev

[jaellio]

@jgreeer if you are interested

[jgreeer]

Since the implicit auth config is based off of the DefaultAzureCredential go library, we could link to that somewhere as a reference. We should just mention that we omit the last two identities, Dev CLI and Powershell.