Skip to content

Commit c9cb1f4

Browse files
andyzhangxandyzhangx
authored
Merge pull request #70 from ZeroMagic/sas_token
feat: add SAS token support
2 parents 0f33fee + f21e106 commit c9cb1f4

File tree

3 files changed

+74
-27
lines changed

3 files changed

+74
-27
lines changed

‎pkg/blobfuse/blobfuse.go

Lines changed: 13 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -159,12 +159,13 @@ func appendDefaultMountOptions(mountOptions []string) []string {
159159
}
160160

161161
// get storage account from secrets map
162-
func getStorageAccount(secrets map[string]string) (string, string, error) {
162+
// returns <accountName, accountKey, accountSasToken>
163+
func getStorageAccount(secrets map[string]string) (string, string, string, error) {
163164
if secrets == nil {
164-
return "", "", fmt.Errorf("unexpected: getStorageAccount secrets is nil")
165+
return "", "", "", fmt.Errorf("unexpected: getStorageAccount secrets is nil")
165166
}
166167

167-
var accountName, accountKey string
168+
var accountName, accountKey, accountSasToken string
168169
for k, v := range secrets {
169170
switch strings.ToLower(k) {
170171
case "accountname":
@@ -175,17 +176,22 @@ func getStorageAccount(secrets map[string]string) (string, string, error) {
175176
accountKey = v
176177
case "azurestorageaccountkey": // for compatability with built-in blobfuse plugin
177178
accountKey = v
179+
case "azurestorageaccountsastoken":
180+
accountSasToken = v
178181
}
179182
}
180183

181184
if accountName == "" {
182-
return "", "", fmt.Errorf("could not find accountname or azurestorageaccountname field secrets(%v)", secrets)
185+
return "", "", "", fmt.Errorf("could not find accountname or azurestorageaccountname field secrets(%v)", secrets)
183186
}
184-
if accountKey == "" {
185-
return "", "", fmt.Errorf("could not find accountkey or azurestorageaccountkey field in secrets(%v)", secrets)
187+
if accountKey == "" && accountSasToken == "" {
188+
return "", "", "", fmt.Errorf("could not find accountkey, azurestorageaccountkey or azurestorageaccountsastoken field in secrets(%v)", secrets)
189+
}
190+
if accountKey != "" && accountSasToken != "" {
191+
return "", "", "", fmt.Errorf("could not specify Access Key and SAS Token together")
186192
}
187193

188-
return accountName, accountKey, nil
194+
return accountName, accountKey, accountSasToken, nil
189195
}
190196

191197
// A container name must be a valid DNS name, conforming to the following naming rules:

‎pkg/blobfuse/blobfuse_test.go

Lines changed: 51 additions & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -123,8 +123,8 @@ func TestGetStorageAccount(t *testing.T) {
123123
}
124124

125125
emptyAccountNameMap := map[string]string{
126-
"azurestorageaccountname": "",
127-
"azurestorageaccountkey": "testkey",
126+
"accountname": "",
127+
"accountkey": "testkey",
128128
}
129129

130130
emptyAzureAccountKeyMap := map[string]string{
@@ -137,11 +137,23 @@ func TestGetStorageAccount(t *testing.T) {
137137
"azurestorageaccountkey": "testkey",
138138
}
139139

140+
emptyAccountSasTokenMap := map[string]string{
141+
"azurestorageaccountname": "testaccount",
142+
"azurestorageaccountsastoken": "",
143+
}
144+
145+
accesskeyAndaccountSasTokenMap := map[string]string{
146+
"azurestorageaccountname": "testaccount",
147+
"azurestorageaccountkey": "testkey",
148+
"azurestorageaccountsastoken": "testkey",
149+
}
150+
140151
tests := []struct {
141152
options map[string]string
142153
expected1 string
143154
expected2 string
144-
expected3 error
155+
expected3 string
156+
expected4 error
145157
}{
146158
{
147159
options: map[string]string{
@@ -150,7 +162,8 @@ func TestGetStorageAccount(t *testing.T) {
150162
},
151163
expected1: "testaccount",
152164
expected2: "testkey",
153-
expected3: nil,
165+
expected3: "",
166+
expected4: nil,
154167
},
155168
{
156169
options: map[string]string{
@@ -159,7 +172,8 @@ func TestGetStorageAccount(t *testing.T) {
159172
},
160173
expected1: "testaccount",
161174
expected2: "testkey",
162-
expected3: nil,
175+
expected3: "",
176+
expected4: nil,
163177
},
164178
{
165179
options: map[string]string{
@@ -168,48 +182,68 @@ func TestGetStorageAccount(t *testing.T) {
168182
},
169183
expected1: "",
170184
expected2: "",
171-
expected3: fmt.Errorf("could not find accountname or azurestorageaccountname field secrets(map[accountname: accountkey:])"),
185+
expected3: "",
186+
expected4: fmt.Errorf("could not find accountname or azurestorageaccountname field secrets(map[accountname: accountkey:])"),
172187
},
173188
{
174189
options: emptyAccountKeyMap,
175190
expected1: "",
176191
expected2: "",
177-
expected3: fmt.Errorf("could not find accountkey or azurestorageaccountkey field in secrets(%v)", emptyAccountKeyMap),
192+
expected3: "",
193+
expected4: fmt.Errorf("could not find accountkey, azurestorageaccountkey or azurestorageaccountsastoken field in secrets(%v)", emptyAccountKeyMap),
178194
},
179195
{
180196
options: emptyAccountNameMap,
181197
expected1: "",
182198
expected2: "",
183-
expected3: fmt.Errorf("could not find accountname or azurestorageaccountname field secrets(%v)", emptyAccountNameMap),
199+
expected3: "",
200+
expected4: fmt.Errorf("could not find accountname or azurestorageaccountname field secrets(%v)", emptyAccountNameMap),
184201
},
185202
{
186203
options: emptyAzureAccountKeyMap,
187204
expected1: "",
188205
expected2: "",
189-
expected3: fmt.Errorf("could not find accountkey or azurestorageaccountkey field in secrets(%v)", emptyAzureAccountKeyMap),
206+
expected3: "",
207+
expected4: fmt.Errorf("could not find accountkey, azurestorageaccountkey or azurestorageaccountsastoken field in secrets(%v)", emptyAzureAccountKeyMap),
190208
},
191209
{
192210
options: emptyAzureAccountNameMap,
193211
expected1: "",
194212
expected2: "",
195-
expected3: fmt.Errorf("could not find accountname or azurestorageaccountname field secrets(%v)", emptyAzureAccountNameMap),
213+
expected3: "",
214+
expected4: fmt.Errorf("could not find accountname or azurestorageaccountname field secrets(%v)", emptyAzureAccountNameMap),
215+
},
216+
{
217+
options: emptyAccountSasTokenMap,
218+
expected1: "",
219+
expected2: "",
220+
expected3: "",
221+
expected4: fmt.Errorf("could not find accountkey, azurestorageaccountkey or azurestorageaccountsastoken field in secrets(%v)", emptyAzureAccountKeyMap),
222+
},
223+
{
224+
options: accesskeyAndaccountSasTokenMap,
225+
expected1: "",
226+
expected2: "",
227+
expected3: "",
228+
expected4: fmt.Errorf("could not specify Access Key and SAS Token together"),
196229
},
197230
{
198231
options: nil,
199232
expected1: "",
200233
expected2: "",
201-
expected3: fmt.Errorf("unexpected: getStorageAccount secrets is nil"),
234+
expected3: "",
235+
expected4: fmt.Errorf("unexpected: getStorageAccount secrets is nil"),
202236
},
203237
}
204238

205239
for _, test := range tests {
206-
result1, result2, result3 := getStorageAccount(test.options)
207-
if !reflect.DeepEqual(result1, test.expected1) || !reflect.DeepEqual(result2, test.expected2) {
208-
t.Errorf("input: %q, getStorageAccount result1: %q, expected1: %q, result2: %q, expected2: %q, result3: %q, expected3: %q", test.options, result1, test.expected1, result2, test.expected2,
209-
result3, test.expected3)
240+
result1, result2, result3, result4 := getStorageAccount(test.options)
241+
if !reflect.DeepEqual(result1, test.expected1) || !reflect.DeepEqual(result2, test.expected2) || !reflect.DeepEqual(result3, test.expected3) {
242+
t.Errorf("input: %q, getStorageAccount result1: %q, expected1: %q, result2: %q, expected2: %q, result3: %q, expected3: %q, result4: %q, expected4: %q", test.options, result1, test.expected1, result2, test.expected2,
243+
result3, test.expected3, result4, test.expected4)
210244
} else {
211-
if result1 == "" || result2 == "" {
212-
assert.Error(t, result3)
245+
if result1 == "" || (result2 == "" && result3 == "") {
246+
assert.Error(t, result4)
213247
}
214248
}
215249
}

‎pkg/blobfuse/nodeserver.go

Lines changed: 10 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -77,7 +77,7 @@ func (d *Driver) NodePublishVolume(ctx context.Context, req *csi.NodePublishVolu
7777
attrib := req.GetVolumeContext()
7878
mountFlags := req.GetVolumeCapability().GetMount().GetMountFlags()
7979

80-
var accountName, accountKey, containerName string
80+
var accountName, accountKey, accountSasToken, containerName string
8181

8282
secrets := req.GetSecrets()
8383
if len(secrets) == 0 {
@@ -106,7 +106,7 @@ func (d *Driver) NodePublishVolume(ctx context.Context, req *csi.NodePublishVolu
106106
return nil, fmt.Errorf("could not find containerName from attributes(%v)", attrib)
107107
}
108108

109-
accountName, accountKey, err = getStorageAccount(secrets)
109+
accountName, accountKey, accountSasToken, err = getStorageAccount(secrets)
110110
if err != nil {
111111
return nil, err
112112
}
@@ -126,7 +126,14 @@ func (d *Driver) NodePublishVolume(ctx context.Context, req *csi.NodePublishVolu
126126
args = args + " " + opt
127127
}
128128
cmd := exec.Command("/usr/blob/blobfuse", strings.Split(args, " ")...)
129-
cmd.Env = append(os.Environ(), "AZURE_STORAGE_ACCOUNT="+accountName, "AZURE_STORAGE_ACCESS_KEY="+accountKey)
129+
cmd.Env = append(os.Environ(), "AZURE_STORAGE_ACCOUNT="+accountName)
130+
131+
if accountSasToken != "" {
132+
cmd.Env = append(cmd.Env, "AZURE_STORAGE_SAS_TOKEN="+accountSasToken)
133+
} else {
134+
cmd.Env = append(cmd.Env, "AZURE_STORAGE_ACCESS_KEY="+accountKey)
135+
}
136+
130137
output, err := cmd.CombinedOutput()
131138
if err != nil {
132139
err = fmt.Errorf("Mount failed with error: %v, output: %v", err, string(output))

0 commit comments

Comments
 (0)