@@ -24,6 +24,7 @@ import (
2424
2525 "sigs.k8s.io/blob-csi-driver/pkg/blob"
2626 "sigs.k8s.io/blob-csi-driver/test/e2e/driver"
27+ "sigs.k8s.io/blob-csi-driver/test/utils/azure"
2728
2829 v1 "k8s.io/api/core/v1"
2930 clientset "k8s.io/client-go/kubernetes"
@@ -39,34 +40,101 @@ type PreProvisionedProvidedCredentiasTest struct {
3940}
4041
4142func (t * PreProvisionedProvidedCredentiasTest ) Run (client clientset.Interface , namespace * v1.Namespace ) {
43+ kvClient , err := azure .NewKeyVaultClient ()
44+ framework .ExpectNoError (err )
45+
46+ authClient , err := azure .NewAuthorizationClient ()
47+ framework .ExpectNoError (err )
48+
4249 for _ , pod := range t .Pods {
4350 for n , volume := range pod .Volumes {
44- accountName , accountKey , accountSasToken , containerName , err := t .Driver .GetStorageAccountAndContainer (context .Background (), volume .VolumeID , nil , nil )
51+ accountName , accountKey , _ , _ , err := t .Driver .GetStorageAccountAndContainer (context .Background (), volume .VolumeID , nil , nil )
4552 framework .ExpectNoError (err , fmt .Sprintf ("Error GetStorageAccountAndContainer from volumeID(%s): %v" , volume .VolumeID , err ))
53+ var secretData map [string ]string
54+
55+ var run = func () {
56+ tsecret := NewTestSecret (client , namespace , volume .NodeStageSecretRef , secretData )
57+ tsecret .Create ()
58+ defer tsecret .Cleanup ()
59+
60+ tpod , cleanup := pod .SetupWithPreProvisionedVolumes (client , namespace , t .CSIDriver )
61+ // defer must be called here for resources not get removed before using them
62+ for i := range cleanup {
63+ defer cleanup [i ]()
64+ }
65+
66+ ginkgo .By ("deploying the pod" )
67+ tpod .Create ()
68+ defer tpod .Cleanup ()
69+ ginkgo .By ("checking that the pods command exits with no error" )
70+ tpod .WaitForSuccess ()
71+ }
4672
47- ginkgo .By ("creating the secret" )
48- secreteData := map [string ]string {"azurestorageaccountname" : accountName }
49- if accountKey != "" {
50- secreteData ["azurestorageaccountkey" ] = accountKey
51- } else {
52- secreteData ["azurestorageaccountsastoken" ] = accountSasToken
73+ // test for storage account key
74+ ginkgo .By ("Run for storage account key" )
75+ secretData = map [string ]string {
76+ "azurestorageaccountname" : accountName ,
77+ "azurestorageaccountkey" : accountKey ,
78+ }
79+ run ()
80+
81+ // test for storage account SAS token
82+ ginkgo .By ("Run for storage account SAS token" )
83+ sasToken := GenerateSASToken (accountName , accountKey )
84+ secretData = map [string ]string {
85+ "azurestorageaccountname" : accountName ,
86+ "azurestorageaccountsastoken" : sasToken ,
87+ }
88+ run ()
89+
90+ // test for service principal
91+ ginkgo .By ("Run for service principal" )
92+ pod .Volumes [n ].Attrib = map [string ]string {
93+ "azurestorageauthtype" : "SPN" ,
94+ "azurestoragespnclientid" : kvClient .Cred .AADClientID ,
95+ "azurestoragespntenantid" : kvClient .Cred .TenantID ,
96+ }
97+ secretData = map [string ]string {
98+ "azurestorageaccountname" : accountName ,
99+ "azurestoragespnclientsecret" : kvClient .Cred .AADClientSecret ,
53100 }
54- tsecret := NewTestSecret (client , namespace , volume .NodeStageSecretRef , secreteData )
55- tsecret .Create ()
56- defer tsecret .Cleanup ()
57-
58- pod .Volumes [n ].ContainerName = containerName
59- tpod , cleanup := pod .SetupWithPreProvisionedVolumes (client , namespace , t .CSIDriver )
60- // defer must be called here for resources not get removed before using them
61- for i := range cleanup {
62- defer cleanup [i ]()
101+
102+ objectID , err := kvClient .GetServicePrincipalObjectID (context .TODO (), kvClient .Cred .AADClientID )
103+ framework .ExpectNoError (err , fmt .Sprintf ("Error GetServicePrincipalObjectID from clientID(%s): %v" , kvClient .Cred .AADClientID , err ))
104+
105+ resourceID := fmt .Sprintf ("/subscriptions/%s/resourceGroups/%s/providers/Microsoft.Storage/storageAccounts/%s" , kvClient .Cred .SubscriptionID , kvClient .Cred .ResourceGroup , accountName )
106+
107+ ginkgo .By (fmt .Sprintf ("assign Storage Blob Data Contributor role to the service principal, objectID:%s" , objectID ))
108+ roleDef , err := authClient .GetRoleDefinition (context .TODO (), resourceID , "Storage Blob Data Contributor" )
109+ framework .ExpectNoError (err , fmt .Sprintf ("Error GetRoleDefinition from resourceID(%s): %v" , resourceID , err ))
110+
111+ roleDefID := * roleDef .ID
112+ _ , err = authClient .AssignRole (context .TODO (), resourceID , objectID , roleDefID )
113+ framework .ExpectNoError (err , fmt .Sprintf ("Error AssignRole (roleDefID(%s)) to objectID(%s) to access resource (resourceID(%s)), error: %v" , roleDefID , objectID , resourceID , err ))
114+
115+ run ()
116+
117+ // test for managed identity
118+ // e2e-vmss test job uses msi blobfuse-csi-driver-e2e-test-id, other jobs use service principal
119+ objectID , err = kvClient .GetMSIObjectID (context .TODO (), "blobfuse-csi-driver-e2e-test-id" )
120+ if err != nil {
121+ return
122+ }
123+
124+ ginkgo .By ("Run for managed identity" )
125+ pod .Volumes [n ].Attrib = map [string ]string {
126+ "azurestorageauthtype" : "MSI" ,
127+ "azurestorageidentityobjectid" : objectID ,
128+ }
129+
130+ secretData = map [string ]string {
131+ "azurestorageaccountname" : accountName ,
63132 }
133+ ginkgo .By (fmt .Sprintf ("assign Storage Blob Data Contributor role to the managed identity, objectID:%s" , objectID ))
134+ _ , err = authClient .AssignRole (context .TODO (), resourceID , objectID , roleDefID )
135+ framework .ExpectNoError (err , fmt .Sprintf ("Error AssignRole (roleDefID(%s)) to objectID(%s) to access resource (resourceID(%s)), error: %v" , roleDefID , objectID , resourceID , err ))
64136
65- ginkgo .By ("deploying the pod" )
66- tpod .Create ()
67- defer tpod .Cleanup ()
68- ginkgo .By ("checking that the pods command exits with no error" )
69- tpod .WaitForSuccess ()
137+ run ()
70138 }
71139 }
72140}
0 commit comments