Skip to content

Commit 371bf40

Browse files
andyzhangxandyzhangx
committed
fix: support getting sasToken, msiSecret, SPN from secret
1 parent abd3afe commit 371bf40

File tree

3 files changed

+85
-26
lines changed

3 files changed

+85
-26
lines changed

‎hack/verify-examples.sh

+2-2
Original file line numberDiff line numberDiff line change
@@ -21,9 +21,9 @@ rollout_and_wait() {
2121

2222
APPNAME=$(kubectl apply -f $1 | grep -E "^(:?daemonset|deployment|statefulset|pod)" | awk '{printf $1}')
2323
if [[ -n $(expr "${APPNAME}" : "\(daemonset\|deployment\|statefulset\)" || true) ]]; then
24-
kubectl rollout status $APPNAME --watch --timeout=5m
24+
kubectl rollout status $APPNAME --watch --timeout=20m
2525
else
26-
kubectl wait "${APPNAME}" --for condition=ready --timeout=5m
26+
kubectl wait "${APPNAME}" --for condition=ready --timeout=20m
2727
fi
2828
}
2929

‎pkg/blob/blob.go

+34-16
Original file line numberDiff line numberDiff line change
@@ -88,6 +88,9 @@ const (
8888
trueValue = "true"
8989
defaultSecretAccountName = "azurestorageaccountname"
9090
defaultSecretAccountKey = "azurestorageaccountkey"
91+
accountSasTokenField = "azurestorageaccountsastoken"
92+
msiSecretField = "msisecret"
93+
storageSPNClientSecretField = "azurestoragespnclientsecret"
9194
Fuse = "fuse"
9295
Fuse2 = "fuse2"
9396
NFS = "nfs"
@@ -364,6 +367,8 @@ func (d *Driver) GetAuthEnv(ctx context.Context, volumeID, protocol string, attr
364367
subsID string
365368
accountKey string
366369
accountSasToken string
370+
msiSecret string
371+
storageSPNClientSecret string
367372
secretName string
368373
pvcNamespace string
369374
keyVaultURL string
@@ -456,15 +461,14 @@ func (d *Driver) GetAuthEnv(ctx context.Context, volumeID, protocol string, attr
456461
if secretName == "" && accountName != "" {
457462
secretName = fmt.Sprintf(secretNameTemplate, accountName)
458463
}
459-
// if msi is specified, don't list account key using cluster identity
460-
if secretName != "" && !strings.EqualFold(azureStorageAuthType, "msi") {
464+
if secretName != "" {
461465
// read from k8s secret first
462466
var name string
463-
name, accountKey, err = d.GetStorageAccountFromSecret(secretName, secretNamespace)
467+
name, accountKey, accountSasToken, msiSecret, storageSPNClientSecret, err = d.GetInfoFromSecret(ctx, secretName, secretNamespace)
464468
if name != "" {
465469
accountName = name
466470
}
467-
if err != nil && !getAccountKeyFromSecret {
471+
if err != nil && !getAccountKeyFromSecret && (azureStorageAuthType == "" || strings.EqualFold(azureStorageAuthType, "key")) {
468472
klog.V(2).Infof("get account(%s) key from secret(%s, %s) failed with error: %v, use cluster identity to get account key instead",
469473
accountName, secretNamespace, secretName, err)
470474
accountKey, err = d.cloud.GetStorageAccesskey(ctx, subsID, accountName, rgName)
@@ -485,12 +489,12 @@ func (d *Driver) GetAuthEnv(ctx context.Context, volumeID, protocol string, attr
485489
accountKey = v
486490
case defaultSecretAccountKey: // for compatibility with built-in blobfuse plugin
487491
accountKey = v
488-
case "azurestorageaccountsastoken":
492+
case accountSasTokenField:
489493
accountSasToken = v
490-
case "msisecret":
491-
authEnv = append(authEnv, "MSI_SECRET="+v)
492-
case "azurestoragespnclientsecret":
493-
authEnv = append(authEnv, "AZURE_STORAGE_SPN_CLIENT_SECRET="+v)
494+
case msiSecretField:
495+
msiSecret = v
496+
case storageSPNClientSecretField:
497+
storageSPNClientSecret = v
494498
}
495499
}
496500
}
@@ -500,12 +504,23 @@ func (d *Driver) GetAuthEnv(ctx context.Context, volumeID, protocol string, attr
500504
err = fmt.Errorf("could not find containerName from attributes(%v) or volumeID(%v)", attrib, volumeID)
501505
}
502506

507+
if accountKey != "" {
508+
authEnv = append(authEnv, "AZURE_STORAGE_ACCESS_KEY="+accountKey)
509+
}
510+
503511
if accountSasToken != "" {
512+
klog.V(2).Infof("accountSasToken is not empty, use it to access storage account(%s), container(%s)", accountName, containerName)
504513
authEnv = append(authEnv, "AZURE_STORAGE_SAS_TOKEN="+accountSasToken)
505514
}
506515

507-
if accountKey != "" {
508-
authEnv = append(authEnv, "AZURE_STORAGE_ACCESS_KEY="+accountKey)
516+
if msiSecret != "" {
517+
klog.V(2).Infof("msiSecret is not empty, use it to access storage account(%s), container(%s)", accountName, containerName)
518+
authEnv = append(authEnv, "MSI_SECRET="+msiSecret)
519+
}
520+
521+
if storageSPNClientSecret != "" {
522+
klog.V(2).Infof("storageSPNClientSecret is not empty, use it to access storage account(%s), container(%s)", accountName, containerName)
523+
authEnv = append(authEnv, "AZURE_STORAGE_SPN_CLIENT_SECRET="+storageSPNClientSecret)
509524
}
510525

511526
return rgName, accountName, accountKey, containerName, authEnv, err
@@ -738,7 +753,7 @@ func (d *Driver) GetStorageAccesskey(ctx context.Context, accountOptions *azure.
738753
if secretName == "" {
739754
secretName = fmt.Sprintf(secretNameTemplate, accountOptions.Name)
740755
}
741-
_, accountKey, err := d.GetStorageAccountFromSecret(secretName, secretNamespace)
756+
_, accountKey, _, _, _, err := d.GetInfoFromSecret(ctx, secretName, secretNamespace) //nolint
742757
if err != nil {
743758
klog.V(2).Infof("could not get account(%s) key from secret(%s) namespace(%s), error: %v, use cluster identity to get account key instead", accountOptions.Name, secretName, secretNamespace, err)
744759
accountKey, err = d.cloud.GetStorageAccesskey(ctx, accountOptions.SubscriptionID, accountOptions.Name, accountOptions.ResourceGroup)
@@ -748,21 +763,24 @@ func (d *Driver) GetStorageAccesskey(ctx context.Context, accountOptions *azure.
748763

749764
// GetStorageAccountFromSecret get storage account key from k8s secret
750765
// return <accountName, accountKey, error>
751-
func (d *Driver) GetStorageAccountFromSecret(secretName, secretNamespace string) (string, string, error) {
766+
func (d *Driver) GetInfoFromSecret(ctx context.Context, secretName, secretNamespace string) (string, string, string, string, string, error) {
752767
if d.cloud.KubeClient == nil {
753-
return "", "", fmt.Errorf("could not get account key from secret(%s): KubeClient is nil", secretName)
768+
return "", "", "", "", "", fmt.Errorf("could not get account key from secret(%s): KubeClient is nil", secretName)
754769
}
755770

756771
secret, err := d.cloud.KubeClient.CoreV1().Secrets(secretNamespace).Get(context.TODO(), secretName, metav1.GetOptions{})
757772
if err != nil {
758-
return "", "", fmt.Errorf("could not get secret(%v): %w", secretName, err)
773+
return "", "", "", "", "", fmt.Errorf("could not get secret(%v): %w", secretName, err)
759774
}
760775

761776
accountName := strings.TrimSpace(string(secret.Data[defaultSecretAccountName][:]))
762777
accountKey := strings.TrimSpace(string(secret.Data[defaultSecretAccountKey][:]))
778+
accountSasToken := strings.TrimSpace(string(secret.Data[accountSasTokenField][:]))
779+
msiSecret := strings.TrimSpace(string(secret.Data[msiSecretField][:]))
780+
spnClientSecret := strings.TrimSpace(string(secret.Data[storageSPNClientSecretField][:]))
763781

764782
klog.V(4).Infof("got storage account(%s) from secret", accountName)
765-
return accountName, accountKey, nil
783+
return accountName, accountKey, accountSasToken, msiSecret, spnClientSecret, nil
766784
}
767785

768786
// getSubnetResourceID get default subnet resource ID from cloud provider config

‎pkg/blob/blob_test.go

+49-8
Original file line numberDiff line numberDiff line change
@@ -1033,7 +1033,7 @@ func TestGetStorageAccesskey(t *testing.T) {
10331033
}
10341034
}
10351035

1036-
func TestGetStorageAccountFromSecret(t *testing.T) {
1036+
func TestGetInfoFromSecret(t *testing.T) {
10371037
fakeClient := fake.NewSimpleClientset()
10381038
testCases := []struct {
10391039
name string
@@ -1047,7 +1047,7 @@ func TestGetStorageAccountFromSecret(t *testing.T) {
10471047
d.cloud.KubeClient = nil
10481048
secretName := "foo"
10491049
secretNamespace := "bar"
1050-
_, _, err := d.GetStorageAccountFromSecret(secretName, secretNamespace)
1050+
_, _, _, _, _, err := d.GetInfoFromSecret(context.TODO(), secretName, secretNamespace)
10511051
expectedErr := fmt.Errorf("could not get account key from secret(%s): KubeClient is nil", secretName)
10521052
if assert.Error(t, err) {
10531053
assert.Equal(t, expectedErr, err)
@@ -1062,7 +1062,7 @@ func TestGetStorageAccountFromSecret(t *testing.T) {
10621062
d.cloud.KubeClient = fakeClient
10631063
secretName := ""
10641064
secretNamespace := ""
1065-
_, _, err := d.GetStorageAccountFromSecret(secretName, secretNamespace)
1065+
_, _, _, _, _, err := d.GetInfoFromSecret(context.TODO(), secretName, secretNamespace)
10661066
// expectedErr := fmt.Errorf("could not get secret(%v): %w", secretName, err)
10671067
assert.Error(t, err) // could not check what type of error, needs fix
10681068
/*if assert.Error(t, err) {
@@ -1071,12 +1071,12 @@ func TestGetStorageAccountFromSecret(t *testing.T) {
10711071
},
10721072
},
10731073
{
1074-
name: "Successful Input",
1074+
name: "get account name from secret",
10751075
testFunc: func(t *testing.T) {
10761076
d := NewFakeDriver()
10771077
d.cloud = &azure.Cloud{}
10781078
d.cloud.KubeClient = fakeClient
1079-
secretName := "john smith"
1079+
secretName := "store_account_name_key"
10801080
secretNamespace := "namespace"
10811081
accountName := "bar"
10821082
accountKey := "foo"
@@ -1095,9 +1095,50 @@ func TestGetStorageAccountFromSecret(t *testing.T) {
10951095
if secretCreateErr != nil {
10961096
t.Error("failed to create secret")
10971097
}
1098-
an, ak, err := d.GetStorageAccountFromSecret(secretName, secretNamespace)
1099-
assert.Equal(t, accountName, an, "accountName's should match")
1100-
assert.Equal(t, accountKey, ak, "accountKey's should match")
1098+
an, ak, accountSasToken, msiSecret, storageSPNClientSecret, err := d.GetInfoFromSecret(context.TODO(), secretName, secretNamespace)
1099+
assert.Equal(t, accountName, an, "accountName should match")
1100+
assert.Equal(t, accountKey, ak, "accountKey should match")
1101+
assert.Equal(t, "", accountSasToken, "accountSasToken should be empty")
1102+
assert.Equal(t, "", msiSecret, "msiSecret should be empty")
1103+
assert.Equal(t, "", storageSPNClientSecret, "storageSPNClientSecret should be empty")
1104+
assert.Equal(t, nil, err, "error should be nil")
1105+
},
1106+
},
1107+
{
1108+
name: "get other info from secret",
1109+
testFunc: func(t *testing.T) {
1110+
d := NewFakeDriver()
1111+
d.cloud = &azure.Cloud{}
1112+
d.cloud.KubeClient = fakeClient
1113+
secretName := "store_other_info"
1114+
secretNamespace := "namespace"
1115+
accountName := "bar"
1116+
accountSasTokenValue := "foo"
1117+
msiSecretValue := "msiSecret"
1118+
storageSPNClientSecretValue := "storageSPNClientSecret"
1119+
secret := &v1api.Secret{
1120+
ObjectMeta: metav1.ObjectMeta{
1121+
Namespace: secretNamespace,
1122+
Name: secretName,
1123+
},
1124+
Data: map[string][]byte{
1125+
defaultSecretAccountName: []byte(accountName),
1126+
accountSasTokenField: []byte(accountSasTokenValue),
1127+
msiSecretField: []byte(msiSecretValue),
1128+
storageSPNClientSecretField: []byte(storageSPNClientSecretValue),
1129+
},
1130+
Type: "Opaque",
1131+
}
1132+
_, secretCreateErr := d.cloud.KubeClient.CoreV1().Secrets(secretNamespace).Create(context.TODO(), secret, metav1.CreateOptions{})
1133+
if secretCreateErr != nil {
1134+
t.Error("failed to create secret")
1135+
}
1136+
an, ak, accountSasToken, msiSecret, storageSPNClientSecret, err := d.GetInfoFromSecret(context.TODO(), secretName, secretNamespace)
1137+
assert.Equal(t, accountName, an, "accountName should match")
1138+
assert.Equal(t, "", ak, "accountKey should be empty")
1139+
assert.Equal(t, accountSasTokenValue, accountSasToken, "sasToken should match")
1140+
assert.Equal(t, msiSecretValue, msiSecret, "msiSecret should match")
1141+
assert.Equal(t, storageSPNClientSecretValue, storageSPNClientSecret, "storageSPNClientSecret should match")
11011142
assert.Equal(t, nil, err, "error should be nil")
11021143
},
11031144
},

0 commit comments

Comments
 (0)