azureclient¶

Resolve the Azure identity chain once, and share it.

azureclient hands out an azcore.TokenCredential — the thing every Azure service client is built from. It exists so that a process using several Azure-backed components resolves the identity chain once rather than once per component.

src := azureclient.Ambient()

cred, err := src.AzureCredential(ctx)
kvClient, _ := azsecrets.NewClient(vaultURL, cred, nil)
acClient, _ := azappconfig.NewClient(endpoint, cred, nil)

Why you would import it¶

Not to use a single adapter — each can resolve its own. You import this when you want one resolution feeding several: Key Vault and App Configuration together, or config alongside go/signing and go/encryption.

Sharing is an explicit act. Nothing here is process-global, because a hidden cache would silently share an identity between components that may deliberately differ.

The rungs¶

The nil that is not nil¶

FromCredential rejects a nil credential with ErrNoCredential — and that check is real work rather than ceremony, because azcore.TokenCredential is an interface.

A caller passing a nil *azidentity.ClientSecretCredential produces a non-nil interface holding a nil pointer. It sails straight past if cred == nil and panics much later, far from the call that caused it. This module checks for the typed-nil case explicitly.

AWS has no equivalent hazard, because aws.Config is a struct. It is worth knowing which of your own seams are interfaces.

Start here¶

• Getting started — one source, two service clients.
• Share one credential across components
• Holding credentials is a posture — why PerCall exists.

Where this comes from¶

org spec 0003 — one module per provider (P-1), yielding the connection prerequisite (P-2), with the typed-nil guard as its P-13 validation.