Access Azure devops repository from gitops by terraform

I'm trying to figure out how to specify the password to Azure DevOps git repository in terraform resource, which means I'm deploying infrastructure by pipeline with inputs.azureSubscription and then deploying AKS cluster by terraform from this pipeline and adding GitOps configuration azurerm_kubernetes_flux_configuration but I cannot figure out how to set credentials for the git. It seems it is possible by setting TF_VAR_name from the Azure pipeline and set PAT from particular pipeline steps.task.env:[TF_VAR_my_git_access_token] $(ACCESS_TOKEN) but I'm sure this is best practice because I have to store it in KeyVault and then pick it up and the second one that I do not manage this PAT. Could you explain how to set azurerm_kubernetes_flux_configuration in the correct way? Maybe somehow through the CSI driver to KeyVault deploy it with federated identity or deploy it by helm charts after the secret is created through CSI. Thank you!

Based on your requirement, you are deploying infrastructure via Azure Pipeline and don't want to manage PAT.

I suggest that you can directly use the Predefined variable: $(system.accesstoken) in Azure Pipeline if the repo and Pipeline are in the same organization.

This variable will be valid during the running of the Pipeline, and it will use the Build Service Account to access the Azure Repo.

It automatically refreshes every time the build runs so you don't have to manage it.

You can refer to the following steps:

Step1: Grant the Repo Read Permission to the Build Service Accounts: YourProjectName Build Service(YourOrganme) and Project Collection Build Service(YourOrgName)

For example:

Note: When you using classic pipeline, you need to enable the otpion: Allow scripts to access the OAuth token

Step2.You can pass the variable with the environment.

variables: 
  TF_VAR_my_git_access_token: $(system.accesstoken)

steps:
- powershell: 'terraform apply'
  displayName: 'PowerShell Script'

Or

- task: TerraformTaskV4@4
  displayName: 'Terraform : azurerm'
  inputs:
    command: apply
    commandOptions: '-var="my_git_access_token=$(system.accesstoken)"'
    environmentServiceNameAzureRM: AzureSerivceConnection

Step3: User the variable in terraform file.

For example:

variable "my_git_access_token" {
  type = string
}

resource "azurerm_kubernetes_flux_configuration" "example" {
  name       = "example-fc"
  cluster_id = azurerm_kubernetes_cluster.test.id
  namespace  = "flux"

  git_repository {
    url             = "repourl"
    reference_type  = "branch"
    reference_value = "main"
    https_key_base64 = base64encode(var.my_git_access_token)
  }

  kustomizations {
    name = "kustomization-1"
  }

  depends_on = [
    azurerm_kubernetes_cluster_extension.example
  ]
}

For more detailed info, you can refer to the docs: System.accesstoken and Access repositories, artifacts, and other resources