I didn’t find this documented anywhere, but in a stack where I created an AKS cluster and then created a kubernetes provider connecting to that cluster using the user credentials, I had to set

AAD_LOGIN_METHOD=azurecli

in the github workflow step to get azure’s kubelogin to use the github workflow’s federated identity. I saw some pulumi issues talking about switching to cluster admin credentials, but that would have meant a loss in auditability as those are shared credentials.