ARO-9391 Remove the Access Key dependency when using Federated Token

Author: rajdeepc2792

pkg/storage/azure/azure.go

@@ -138,6 +138,10 @@ func GetConfig(secLister kcorelisters.SecretNamespaceLister, infraLister configl
 	}, nil
 }
 
+func isAzureStackCloud(name string) bool {
+	return strings.EqualFold(name, "AZURESTACKCLOUD")
+}
+
 func getEnvironmentByName(name string) (autorestazure.Environment, error) {
 	if name == "" {
 		return autorestazure.PublicCloud, nil
@@ -179,13 +183,14 @@ func (d *driver) createStorageAccount(storageAccountsClient storage.AccountsClie
 	// disabling public network access at all... either we update the storage
 	// account after creation using the new sdk, or we use the new sdk to create it
 	// outside of azure stack hub, and the old sdk for azure stack hub.
+	// Also doesn't support AccessKey usage disabling
 	params := &storage.AccountPropertiesCreateParameters{
 		EnableHTTPSTrafficOnly: to.BoolPtr(true),
 		AllowBlobPublicAccess:  to.BoolPtr(false),
 		MinimumTLSVersion:      storage.TLS12,
 	}
 
-	if strings.EqualFold(cloudName, "AZURESTACKCLOUD") {
+	if isAzureStackCloud(cloudName) {
 		// It seems Azure Stack Hub does not support new API.
 		kind = storage.Storage
 		params = &storage.AccountPropertiesCreateParameters{}
@@ -314,6 +319,22 @@ func NewDriver(ctx context.Context, c *imageregistryv1.ImageRegistryConfigStorag
 	}
 }
 
+func (d *driver) newAzClient(cfg *Azure, environment autorestazure.Environment, tagset map[string]*string) (*azureclient.Client, error) {
+	client, err := azureclient.New(&azureclient.Options{
+		Environment:        environment,
+		TenantID:           cfg.TenantID,
+		ClientID:           cfg.ClientID,
+		ClientSecret:       cfg.ClientSecret,
+		FederatedTokenFile: cfg.FederatedTokenFile,
+		SubscriptionID:     cfg.SubscriptionID,
+		TagSet:             tagset,
+	})
+	if err != nil {
+		return nil, err
+	}
+	return client, nil
+}
+
 func (d *driver) storageAccountsClient(cfg *Azure, environment autorestazure.Environment) (storage.AccountsClient, error) {
 	storageAccountsClient := storage.NewAccountsClientWithBaseURI(environment.ResourceManagerEndpoint, cfg.SubscriptionID)
 	storageAccountsClient.PollingDelay = 10 * time.Second
@@ -516,6 +537,48 @@ func (d *driver) containerExists(ctx context.Context, environment autorestazure.
 	return true, nil
 }
 
+func (d *driver) storageExistsViaTrack2SDK(cr *imageregistryv1.Config, cfg *Azure, environment autorestazure.Environment) (exists bool, err error) {
+	key := cfg.AccountKey
+	federated_token := cfg.FederatedTokenFile
+	azClient, err := d.newAzClient(cfg, environment, nil)
+	if err != nil {
+		util.UpdateCondition(cr, defaults.StorageExists, operatorapiv1.ConditionUnknown, storageExistsReasonAzureError, fmt.Sprintf("Unable to create azure client: %s", err))
+		return false, err
+	}
+	if key == "" && federated_token == "" {
+		key, err = d.getKey(cfg, environment)
+		if err != nil {
+			util.UpdateCondition(cr, defaults.StorageExists, operatorapiv1.ConditionUnknown, storageExistsReasonAzureError, fmt.Sprintf("Unable to get storage account key: %s", err))
+			return false, err
+		}
+
+	}
+
+	u, err := getBlobServiceURL(environment, d.Config.AccountName)
+	if err != nil {
+		util.UpdateCondition(cr, defaults.StorageExists, operatorapiv1.ConditionUnknown, storageExistsReasonConfigError, fmt.Sprintf("Unable to parse blob url: %s", err))
+		return false, err
+	}
+	blobClient, err := azClient.NewBlobClient(environment, d.Config.AccountName, key, fmt.Sprintf("%s://%s/", u.Scheme, u.Host))
+	if err != nil {
+		util.UpdateCondition(cr, defaults.StorageExists, operatorapiv1.ConditionUnknown, storageExistsReasonAzureError, fmt.Sprintf("Unable to create blob client: %s", err))
+		return false, err
+	}
+
+	exists, err = blobClient.ContainerExists(d.Context, d.Config.AccountName, d.Config.Container)
+	if err != nil {
+		util.UpdateCondition(cr, defaults.StorageExists, operatorapiv1.ConditionUnknown, storageExistsReasonAzureError, fmt.Sprintf("%s", err))
+		return false, err
+	}
+	if !exists {
+		util.UpdateCondition(cr, defaults.StorageExists, operatorapiv1.ConditionFalse, storageExistsReasonContainerNotFound, fmt.Sprintf("Could not find storage container %s", d.Config.Container))
+		return false, nil
+	}
+
+	util.UpdateCondition(cr, defaults.StorageExists, operatorapiv1.ConditionTrue, storageExistsReasonContainerExists, "Storage container exists")
+	return true, nil
+}
+
 // StorageExists checks if the storage container exists and is accessible.
 func (d *driver) StorageExists(cr *imageregistryv1.Config) (bool, error) {
 	if d.Config.AccountName == "" || d.Config.Container == "" {
@@ -535,6 +598,10 @@ func (d *driver) StorageExists(cr *imageregistryv1.Config) (bool, error) {
 		return false, err
 	}
 
+	if !isAzureStackCloud(d.Config.CloudName) {
+		return d.storageExistsViaTrack2SDK(cr, cfg, environment)
+	}
+
 	key, err := d.getKey(cfg, environment)
 	if err != nil {
 		util.UpdateCondition(cr, defaults.StorageExists, operatorapiv1.ConditionUnknown, storageExistsReasonAzureError, fmt.Sprintf("Unable to get storage account key: %s", err))
@@ -570,15 +637,7 @@ func (d *driver) assurePrivateAccount(cfg *Azure, infra *configv1.Infrastructure
 	if err != nil {
 		return "", err
 	}
-	azclient, err := azureclient.New(&azureclient.Options{
-		Environment:        environment,
-		TenantID:           cfg.TenantID,
-		ClientID:           cfg.ClientID,
-		ClientSecret:       cfg.ClientSecret,
-		FederatedTokenFile: cfg.FederatedTokenFile,
-		SubscriptionID:     cfg.SubscriptionID,
-		TagSet:             tagset,
-	})
+	azclient, err := d.newAzClient(cfg, environment, tagset)
 	if err != nil {
 		return "", err
 	}
@@ -708,9 +767,83 @@ func (d *driver) assureStorageAccount(cfg *Azure, infra *configv1.Infrastructure
 		}
 	}
 
+	if !isAzureStackCloud(d.Config.CloudName) && cfg.FederatedTokenFile != "" {
+		azClient, err := d.newAzClient(cfg, environment, tagset)
+		if err != nil {
+			return "", false, err
+		}
+		err = azClient.DisableStorageAccountAccessKeyAccess(d.Context, cfg.ResourceGroup, accountName)
+		if err != nil {
+			return "", false, err
+		}
+	}
+
 	return accountName, storageAccountCreated, nil
 }
 
+func (d *driver) assureContainerViaTrack2SDK(cfg *Azure) (string, bool, error) {
+	environment, err := getEnvironmentByName(d.Config.CloudName)
+	if err != nil {
+		return "", false, err
+	}
+	key := cfg.AccountKey
+	federated_token := cfg.FederatedTokenFile
+	azClient, err := d.newAzClient(cfg, environment, nil)
+	if err != nil {
+		return "", false, err
+	}
+	if key == "" && federated_token == "" {
+		storageAccountsClient, err := d.storageAccountsClient(cfg, environment)
+		if err != nil {
+			return "", false, err
+		}
+		key, err = d.getAccountPrimaryKey(
+			storageAccountsClient, cfg.ResourceGroup, d.Config.AccountName,
+		)
+		if err != nil {
+			return "", false, err
+		}
+	}
+
+	u, err := getBlobServiceURL(environment, d.Config.AccountName)
+	if err != nil {
+		return "", false, err
+	}
+	blobClient, err := azClient.NewBlobClient(environment, d.Config.AccountName, key, fmt.Sprintf("%s://%s/", u.Scheme, u.Host))
+	if err != nil {
+		return "", false, err
+	}
+	if d.Config.Container == "" {
+		containerName, err := util.GenerateStorageName(d.Listers, "")
+		if err != nil {
+			return "", false, err
+		}
+
+		if err = blobClient.CreateStorageContainer(
+			d.Context, containerName,
+		); err != nil {
+			return "", false, err
+		}
+
+		return containerName, true, nil
+	}
+
+	if exists, err := blobClient.ContainerExists(
+		d.Context, d.Config.AccountName, d.Config.Container,
+	); err != nil {
+		return "", false, err
+	} else if exists {
+		return d.Config.Container, false, nil
+	}
+
+	if err = blobClient.CreateStorageContainer(
+		d.Context, d.Config.Container,
+	); err != nil {
+		return "", false, err
+	}
+	return d.Config.Container, true, nil
+}
+
 // assureContainer makes sure we have a container in place. Container name may be provided or
 // generated automatically. Returns the container name (the provided one or the automatically
 // generated), if the container was created or was already there and an error.
@@ -880,7 +1013,13 @@ func (d *driver) CreateStorage(cr *imageregistryv1.Config) error {
 	}
 	d.Config.AccountName = storageAccountName
 
-	containerName, containerCreated, err := d.assureContainer(cfg)
+	var containerName string
+	var containerCreated bool
+	if isAzureStackCloud(d.Config.CloudName) {
+		containerName, containerCreated, err = d.assureContainer(cfg)
+	} else {
+		containerName, containerCreated, err = d.assureContainerViaTrack2SDK(cfg)
+	}
 	if err != nil {
 		util.UpdateCondition(
 			cr,
@@ -937,6 +1076,75 @@ func (d *driver) CreateStorage(cr *imageregistryv1.Config) error {
 	return nil
 }
 
+func (d *driver) removeStorageContainerViaTrack2SDK(cr *imageregistryv1.Config, cfg *Azure, environment autorestazure.Environment, storageAccountsClient storage.AccountsClient) (exists bool, err error) {
+	key := cfg.AccountKey
+	federated_token := cfg.FederatedTokenFile
+	azClient, err := d.newAzClient(cfg, environment, nil)
+	if err != nil {
+		util.UpdateCondition(cr, defaults.StorageExists, operatorapiv1.ConditionUnknown, storageExistsReasonAzureError, fmt.Sprintf("Unable to create azure client: %s", err))
+		return false, err
+	}
+	if key == "" && federated_token == "" {
+		key, err = d.getAccountPrimaryKey(storageAccountsClient, cfg.ResourceGroup, d.Config.AccountName)
+		if _, ok := err.(*errDoesNotExist); ok {
+			d.Config.AccountName = ""
+			cr.Spec.Storage.Azure.AccountName = "" // TODO
+			cr.Status.Storage.Azure.AccountName = ""
+			util.UpdateCondition(cr, defaults.StorageExists, operatorapiv1.ConditionFalse, storageExistsReasonContainerNotFound, fmt.Sprintf("Container has been already deleted: %s", err))
+			return false, nil
+		}
+	}
+
+	u, err := getBlobServiceURL(environment, d.Config.AccountName)
+	if err != nil {
+		util.UpdateCondition(cr, defaults.StorageExists, operatorapiv1.ConditionUnknown, storageExistsReasonConfigError, fmt.Sprintf("Unable to parse blob url: %s", err))
+		return false, err
+	}
+	blobClient, err := azClient.NewBlobClient(environment, d.Config.AccountName, key, fmt.Sprintf("%s://%s/", u.Scheme, u.Host))
+	if err != nil {
+		util.UpdateCondition(cr, defaults.StorageExists, operatorapiv1.ConditionUnknown, storageExistsReasonAzureError, fmt.Sprintf("Unable to create blob client: %s", err))
+		return false, err
+	}
+	err = blobClient.DeleteStorageContainer(d.Context, d.Config.Container)
+	if err != nil {
+		util.UpdateCondition(cr, defaults.StorageExists, operatorapiv1.ConditionUnknown, storageExistsReasonAzureError, fmt.Sprintf("Unable to delete storage container: %s", err))
+		return false, err // TODO: is it retryable?
+	}
+
+	d.Config.Container = ""
+	cr.Spec.Storage.Azure.Container = "" // TODO: what if it was provided by a user?
+	cr.Status.Storage.Azure.Container = ""
+	util.UpdateCondition(cr, defaults.StorageExists, operatorapiv1.ConditionFalse, storageExistsReasonContainerDeleted, "Storage container has been deleted")
+	return true, nil
+}
+
+func (d *driver) removeStorageContainer(cr *imageregistryv1.Config, cfg *Azure, environment autorestazure.Environment, storageAccountsClient storage.AccountsClient) (exists bool, err error) {
+	key, err := d.getAccountPrimaryKey(storageAccountsClient, cfg.ResourceGroup, d.Config.AccountName)
+	if _, ok := err.(*errDoesNotExist); ok {
+		d.Config.AccountName = ""
+		cr.Spec.Storage.Azure.AccountName = "" // TODO
+		cr.Status.Storage.Azure.AccountName = ""
+		util.UpdateCondition(cr, defaults.StorageExists, operatorapiv1.ConditionFalse, storageExistsReasonContainerNotFound, fmt.Sprintf("Container has been already deleted: %s", err))
+		return false, nil
+	}
+	if err != nil {
+		util.UpdateCondition(cr, defaults.StorageExists, operatorapiv1.ConditionUnknown, storageExistsReasonAzureError, fmt.Sprintf("Unable to get account primary keys: %s", err))
+		return false, err
+	}
+
+	err = d.deleteStorageContainer(environment, d.Config.AccountName, key, d.Config.Container)
+	if err != nil {
+		util.UpdateCondition(cr, defaults.StorageExists, operatorapiv1.ConditionUnknown, storageExistsReasonAzureError, fmt.Sprintf("Unable to delete storage container: %s", err))
+		return false, err // TODO: is it retryable?
+	}
+
+	d.Config.Container = ""
+	cr.Spec.Storage.Azure.Container = "" // TODO: what if it was provided by a user?
+	cr.Status.Storage.Azure.Container = ""
+	util.UpdateCondition(cr, defaults.StorageExists, operatorapiv1.ConditionFalse, storageExistsReasonContainerDeleted, "Storage container has been deleted")
+	return true, nil
+}
+
 // RemoveStorage deletes the storage medium that was created.
 func (d *driver) RemoveStorage(cr *imageregistryv1.Config) (retry bool, err error) {
 	if cr.Spec.Storage.ManagementState != imageregistryv1.StorageManagementStateManaged {
@@ -1016,29 +1224,18 @@ func (d *driver) RemoveStorage(cr *imageregistryv1.Config) (retry bool, err erro
 	}
 
 	if d.Config.Container != "" {
-		key, err := d.getAccountPrimaryKey(storageAccountsClient, cfg.ResourceGroup, d.Config.AccountName)
-		if _, ok := err.(*errDoesNotExist); ok {
-			d.Config.AccountName = ""
-			cr.Spec.Storage.Azure.AccountName = "" // TODO
-			cr.Status.Storage.Azure.AccountName = ""
-			util.UpdateCondition(cr, defaults.StorageExists, operatorapiv1.ConditionFalse, storageExistsReasonContainerNotFound, fmt.Sprintf("Container has been already deleted: %s", err))
-			return false, nil
+		var exists bool
+		if isAzureStackCloud(d.Config.CloudName) {
+			exists, err = d.removeStorageContainer(cr, cfg, environment, storageAccountsClient)
+		} else {
+			exists, err = d.removeStorageContainerViaTrack2SDK(cr, cfg, environment, storageAccountsClient)
 		}
 		if err != nil {
-			util.UpdateCondition(cr, defaults.StorageExists, operatorapiv1.ConditionUnknown, storageExistsReasonAzureError, fmt.Sprintf("Unable to get account primary keys: %s", err))
 			return false, err
 		}
-
-		err = d.deleteStorageContainer(environment, d.Config.AccountName, key, d.Config.Container)
-		if err != nil {
-			util.UpdateCondition(cr, defaults.StorageExists, operatorapiv1.ConditionUnknown, storageExistsReasonAzureError, fmt.Sprintf("Unable to delete storage container: %s", err))
-			return false, err // TODO: is it retryable?
+		if !exists {
+			return false, nil
 		}
-
-		d.Config.Container = ""
-		cr.Spec.Storage.Azure.Container = "" // TODO: what if it was provided by a user?
-		cr.Status.Storage.Azure.Container = ""
-		util.UpdateCondition(cr, defaults.StorageExists, operatorapiv1.ConditionFalse, storageExistsReasonContainerDeleted, "Storage container has been deleted")
 	}
 
 	_, err = storageAccountsClient.Delete(d.Context, cfg.ResourceGroup, d.Config.AccountName)