Skip to content

Commit d04c2a5

Browse files
andyzhangxandyzhangx
authored
Merge pull request #942 from andyzhangx/spntenantid-secret
feat: support setting AzureStorageSPNClientID/TenantId in secret
2 parents da1ee37 + 042500a commit d04c2a5

File tree

3 files changed

+51
-17
lines changed

3 files changed

+51
-17
lines changed

‎docs/driver-parameters.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -103,7 +103,7 @@ volumeAttributes.keyVaultSecretVersion | Azure Key Vault secret version | existi
103103
kubectl create secret generic azure-secret --from-literal=azurestorageaccountname="xxx" --from-literal azurestorageaccountkey="xxx" --type=Opaque
104104
kubectl create secret generic azure-secret --from-literal=azurestorageaccountname="xxx" --from-literal azurestorageaccountsastoken="xxx" --type=Opaque
105105
kubectl create secret generic azure-secret --from-literal msisecret="xxx" --type=Opaque
106-
kubectl create secret generic azure-secret --from-literal azurestoragespnclientsecret="xxx" --type=Opaque
106+
kubectl create secret generic azure-secret --from-literal azurestoragespnclientsecret="xxx" azurestoragespnclientid="xxx" azurestoragespntenantid="xxx" --type=Opaque
107107
```
108108

109109
### Tips

‎pkg/blob/blob.go

Lines changed: 38 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -75,6 +75,8 @@ const (
7575
softDeleteContainersField = "softdeletecontainers"
7676
enableBlobVersioningField = "enableblobversioning"
7777
getAccountKeyFromSecretField = "getaccountkeyfromsecret"
78+
storageSPNClientIDField = "azurestoragespnclientid"
79+
storageSPNTenantIDField = "azurestoragespntenantid"
7880
keyVaultURLField = "keyvaulturl"
7981
keyVaultSecretNameField = "keyvaultsecretname"
8082
keyVaultSecretVersionField = "keyvaultsecretversion"
@@ -369,6 +371,8 @@ func (d *Driver) GetAuthEnv(ctx context.Context, volumeID, protocol string, attr
369371
accountSasToken string
370372
msiSecret string
371373
storageSPNClientSecret string
374+
storageSPNClientID string
375+
storageSPNTenantID string
372376
secretName string
373377
pvcNamespace string
374378
keyVaultURL string
@@ -416,10 +420,10 @@ func (d *Driver) GetAuthEnv(ctx context.Context, volumeID, protocol string, attr
416420
authEnv = append(authEnv, "AZURE_STORAGE_IDENTITY_RESOURCE_ID="+v)
417421
case "msiendpoint":
418422
authEnv = append(authEnv, "MSI_ENDPOINT="+v)
419-
case "azurestoragespnclientid":
420-
authEnv = append(authEnv, "AZURE_STORAGE_SPN_CLIENT_ID="+v)
421-
case "azurestoragespntenantid":
422-
authEnv = append(authEnv, "AZURE_STORAGE_SPN_TENANT_ID="+v)
423+
case storageSPNClientIDField:
424+
storageSPNClientID = v
425+
case storageSPNTenantIDField:
426+
storageSPNTenantID = v
423427
case "azurestorageaadendpoint":
424428
authEnv = append(authEnv, "AZURE_STORAGE_AAD_ENDPOINT="+v)
425429
}
@@ -463,11 +467,17 @@ func (d *Driver) GetAuthEnv(ctx context.Context, volumeID, protocol string, attr
463467
}
464468
if secretName != "" {
465469
// read from k8s secret first
466-
var name string
467-
name, accountKey, accountSasToken, msiSecret, storageSPNClientSecret, err = d.GetInfoFromSecret(ctx, secretName, secretNamespace)
470+
var name, spnClientID, spnTenantID string
471+
name, accountKey, accountSasToken, msiSecret, storageSPNClientSecret, spnClientID, spnTenantID, err = d.GetInfoFromSecret(ctx, secretName, secretNamespace)
468472
if name != "" {
469473
accountName = name
470474
}
475+
if spnClientID != "" {
476+
storageSPNClientID = spnClientID
477+
}
478+
if spnTenantID != "" {
479+
storageSPNTenantID = spnTenantID
480+
}
471481
if err != nil && strings.EqualFold(azureStorageAuthType, "msi") {
472482
klog.V(2).Infof("ignore error(%v) since secret is optional for auth type(%s)", err, azureStorageAuthType)
473483
err = nil
@@ -499,6 +509,10 @@ func (d *Driver) GetAuthEnv(ctx context.Context, volumeID, protocol string, attr
499509
msiSecret = v
500510
case storageSPNClientSecretField:
501511
storageSPNClientSecret = v
512+
case storageSPNClientIDField:
513+
storageSPNClientID = v
514+
case storageSPNTenantIDField:
515+
storageSPNTenantID = v
502516
}
503517
}
504518
}
@@ -527,6 +541,16 @@ func (d *Driver) GetAuthEnv(ctx context.Context, volumeID, protocol string, attr
527541
authEnv = append(authEnv, "AZURE_STORAGE_SPN_CLIENT_SECRET="+storageSPNClientSecret)
528542
}
529543

544+
if storageSPNClientID != "" {
545+
klog.V(2).Infof("storageSPNClientID(%s) is not empty, use it to access storage account(%s), container(%s)", storageSPNClientID, accountName, containerName)
546+
authEnv = append(authEnv, "AZURE_STORAGE_SPN_CLIENT_ID="+storageSPNClientID)
547+
}
548+
549+
if storageSPNTenantID != "" {
550+
klog.V(2).Infof("storageSPNTenantID(%s) is not empty, use it to access storage account(%s), container(%s)", storageSPNTenantID, accountName, containerName)
551+
authEnv = append(authEnv, "AZURE_STORAGE_SPN_TENANT_ID="+storageSPNTenantID)
552+
}
553+
530554
return rgName, accountName, accountKey, containerName, authEnv, err
531555
}
532556

@@ -757,7 +781,7 @@ func (d *Driver) GetStorageAccesskey(ctx context.Context, accountOptions *azure.
757781
if secretName == "" {
758782
secretName = fmt.Sprintf(secretNameTemplate, accountOptions.Name)
759783
}
760-
_, accountKey, _, _, _, err := d.GetInfoFromSecret(ctx, secretName, secretNamespace) //nolint
784+
_, accountKey, _, _, _, _, _, err := d.GetInfoFromSecret(ctx, secretName, secretNamespace) //nolint
761785
if err != nil {
762786
klog.V(2).Infof("could not get account(%s) key from secret(%s) namespace(%s), error: %v, use cluster identity to get account key instead", accountOptions.Name, secretName, secretNamespace, err)
763787
accountKey, err = d.cloud.GetStorageAccesskey(ctx, accountOptions.SubscriptionID, accountOptions.Name, accountOptions.ResourceGroup)
@@ -766,25 +790,27 @@ func (d *Driver) GetStorageAccesskey(ctx context.Context, accountOptions *azure.
766790
}
767791

768792
// GetInfoFromSecret get info from k8s secret
769-
// return <accountName, accountKey, accountSasToken, msiSecret, spnClientSecret, error>
770-
func (d *Driver) GetInfoFromSecret(ctx context.Context, secretName, secretNamespace string) (string, string, string, string, string, error) {
793+
// return <accountName, accountKey, accountSasToken, msiSecret, spnClientSecret, spnClientID, spnTenantID, error>
794+
func (d *Driver) GetInfoFromSecret(ctx context.Context, secretName, secretNamespace string) (string, string, string, string, string, string, string, error) {
771795
if d.cloud.KubeClient == nil {
772-
return "", "", "", "", "", fmt.Errorf("could not get account key from secret(%s): KubeClient is nil", secretName)
796+
return "", "", "", "", "", "", "", fmt.Errorf("could not get account key from secret(%s): KubeClient is nil", secretName)
773797
}
774798

775799
secret, err := d.cloud.KubeClient.CoreV1().Secrets(secretNamespace).Get(ctx, secretName, metav1.GetOptions{})
776800
if err != nil {
777-
return "", "", "", "", "", fmt.Errorf("could not get secret(%v): %w", secretName, err)
801+
return "", "", "", "", "", "", "", fmt.Errorf("could not get secret(%v): %w", secretName, err)
778802
}
779803

780804
accountName := strings.TrimSpace(string(secret.Data[defaultSecretAccountName][:]))
781805
accountKey := strings.TrimSpace(string(secret.Data[defaultSecretAccountKey][:]))
782806
accountSasToken := strings.TrimSpace(string(secret.Data[accountSasTokenField][:]))
783807
msiSecret := strings.TrimSpace(string(secret.Data[msiSecretField][:]))
784808
spnClientSecret := strings.TrimSpace(string(secret.Data[storageSPNClientSecretField][:]))
809+
spnClientID := strings.TrimSpace(string(secret.Data[storageSPNClientIDField][:]))
810+
spnTenantID := strings.TrimSpace(string(secret.Data[storageSPNTenantIDField][:]))
785811

786812
klog.V(4).Infof("got storage account(%s) from secret", accountName)
787-
return accountName, accountKey, accountSasToken, msiSecret, spnClientSecret, nil
813+
return accountName, accountKey, accountSasToken, msiSecret, spnClientSecret, spnClientID, spnTenantID, nil
788814
}
789815

790816
// getSubnetResourceID get default subnet resource ID from cloud provider config

‎pkg/blob/blob_test.go

Lines changed: 12 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1046,7 +1046,7 @@ func TestGetInfoFromSecret(t *testing.T) {
10461046
d.cloud.KubeClient = nil
10471047
secretName := "foo"
10481048
secretNamespace := "bar"
1049-
_, _, _, _, _, err := d.GetInfoFromSecret(context.TODO(), secretName, secretNamespace)
1049+
_, _, _, _, _, _, _, err := d.GetInfoFromSecret(context.TODO(), secretName, secretNamespace)
10501050
expectedErr := fmt.Errorf("could not get account key from secret(%s): KubeClient is nil", secretName)
10511051
if assert.Error(t, err) {
10521052
assert.Equal(t, expectedErr, err)
@@ -1061,7 +1061,7 @@ func TestGetInfoFromSecret(t *testing.T) {
10611061
d.cloud.KubeClient = fakeClient
10621062
secretName := ""
10631063
secretNamespace := ""
1064-
_, _, _, _, _, err := d.GetInfoFromSecret(context.TODO(), secretName, secretNamespace)
1064+
_, _, _, _, _, _, _, err := d.GetInfoFromSecret(context.TODO(), secretName, secretNamespace)
10651065
// expectedErr := fmt.Errorf("could not get secret(%v): %w", secretName, err)
10661066
assert.Error(t, err) // could not check what type of error, needs fix
10671067
/*if assert.Error(t, err) {
@@ -1094,12 +1094,14 @@ func TestGetInfoFromSecret(t *testing.T) {
10941094
if secretCreateErr != nil {
10951095
t.Error("failed to create secret")
10961096
}
1097-
an, ak, accountSasToken, msiSecret, storageSPNClientSecret, err := d.GetInfoFromSecret(context.TODO(), secretName, secretNamespace)
1097+
an, ak, accountSasToken, msiSecret, storageSPNClientSecret, storageSPNClientID, storageSPNTenantID, err := d.GetInfoFromSecret(context.TODO(), secretName, secretNamespace)
10981098
assert.Equal(t, accountName, an, "accountName should match")
10991099
assert.Equal(t, accountKey, ak, "accountKey should match")
11001100
assert.Equal(t, "", accountSasToken, "accountSasToken should be empty")
11011101
assert.Equal(t, "", msiSecret, "msiSecret should be empty")
11021102
assert.Equal(t, "", storageSPNClientSecret, "storageSPNClientSecret should be empty")
1103+
assert.Equal(t, "", storageSPNClientID, "storageSPNClientID should be empty")
1104+
assert.Equal(t, "", storageSPNTenantID, "storageSPNTenantID should be empty")
11031105
assert.Equal(t, nil, err, "error should be nil")
11041106
},
11051107
},
@@ -1115,6 +1117,8 @@ func TestGetInfoFromSecret(t *testing.T) {
11151117
accountSasTokenValue := "foo"
11161118
msiSecretValue := "msiSecret"
11171119
storageSPNClientSecretValue := "storageSPNClientSecret"
1120+
storageSPNClientIDValue := "storageSPNClientID"
1121+
storageSPNTenantIDValue := "storageSPNTenantID"
11181122
secret := &v1api.Secret{
11191123
ObjectMeta: metav1.ObjectMeta{
11201124
Namespace: secretNamespace,
@@ -1125,19 +1129,23 @@ func TestGetInfoFromSecret(t *testing.T) {
11251129
accountSasTokenField: []byte(accountSasTokenValue),
11261130
msiSecretField: []byte(msiSecretValue),
11271131
storageSPNClientSecretField: []byte(storageSPNClientSecretValue),
1132+
storageSPNClientIDField: []byte(storageSPNClientIDValue),
1133+
storageSPNTenantIDField: []byte(storageSPNTenantIDValue),
11281134
},
11291135
Type: "Opaque",
11301136
}
11311137
_, secretCreateErr := d.cloud.KubeClient.CoreV1().Secrets(secretNamespace).Create(context.TODO(), secret, metav1.CreateOptions{})
11321138
if secretCreateErr != nil {
11331139
t.Error("failed to create secret")
11341140
}
1135-
an, ak, accountSasToken, msiSecret, storageSPNClientSecret, err := d.GetInfoFromSecret(context.TODO(), secretName, secretNamespace)
1141+
an, ak, accountSasToken, msiSecret, storageSPNClientSecret, storageSPNClientID, storageSPNTenantID, err := d.GetInfoFromSecret(context.TODO(), secretName, secretNamespace)
11361142
assert.Equal(t, accountName, an, "accountName should match")
11371143
assert.Equal(t, "", ak, "accountKey should be empty")
11381144
assert.Equal(t, accountSasTokenValue, accountSasToken, "sasToken should match")
11391145
assert.Equal(t, msiSecretValue, msiSecret, "msiSecret should match")
11401146
assert.Equal(t, storageSPNClientSecretValue, storageSPNClientSecret, "storageSPNClientSecret should match")
1147+
assert.Equal(t, storageSPNClientIDValue, storageSPNClientID, "storageSPNClientID should match")
1148+
assert.Equal(t, storageSPNTenantIDValue, storageSPNTenantID, "storageSPNTenantID should match")
11411149
assert.Equal(t, nil, err, "error should be nil")
11421150
},
11431151
},

0 commit comments

Comments
 (0)