fix

Author: andyzhangx

pkg/blob/blob.go

@@ -162,7 +162,7 @@ const (
 
 	DefaultTokenAudience = "api://AzureADTokenExchange" //nolint:gosec // G101 ignore this!
 
-	defaultAzureFederatedTokenDir = "/var/lib/kubelet/" + DefaultDriverName
+	defaultAzureFederatedTokenDir = "/var/lib/kubelet/plugins/" + DefaultDriverName
 )
 
 var (
@@ -590,15 +590,15 @@ func (d *Driver) GetAuthEnv(ctx context.Context, volumeID, protocol string, attr
 			}
 			azureFederatedTokenFile := filepath.Join(defaultAzureFederatedTokenDir, clientID)
 			klog.V(2).Infof("write workload identity token to %s", azureFederatedTokenFile)
-			if err := os.WriteFile(azureFederatedTokenFile, []byte(workloadIdentityToken), 0644); err != nil {
+			if err := os.WriteFile(azureFederatedTokenFile, []byte(workloadIdentityToken), 0600); err != nil {
 				return rgName, accountName, accountKey, containerName, authEnv, fmt.Errorf("failed to write azure federated token file %s: %v", azureFederatedTokenFile, err)
 			}
 
 			authEnv = append(authEnv, "AZURE_STORAGE_SPN_CLIENT_ID="+clientID)
 			if tenantID != "" {
 				authEnv = append(authEnv, "AZURE_STORAGE_SPN_TENANT_ID="+tenantID)
 			}
-			authEnv = append(authEnv, "AZURE_FEDERATED_TOKEN_FILE="+azureFederatedTokenFile)
+			authEnv = append(authEnv, "AZURE_OAUTH_TOKEN_FILE="+azureFederatedTokenFile)
 
 			return rgName, accountName, accountKey, containerName, authEnv, err
 		}

pkg/blob/nodeserver_test.go

@@ -244,7 +244,7 @@ func TestNodePublishVolume(t *testing.T) {
 				d.cloud.ResourceGroup = "rg"
 				d.enableBlobMockMount = true
 				// Create the directory for token file
-				_ = makeDir("/var/lib/kubelet/blob.csi.azure.com/")
+				_ = makeDir("/var/lib/kubelet/plugins/blob.csi.azure.com/")
 			},
 			req: &csi.NodePublishVolumeRequest{
 				VolumeCapability:  &csi.VolumeCapability{AccessMode: &volumeCap},