Skip to content

Commit 5432180

Browse files
andyzhangxandyzhangx
committed
feat: support getting sasToken, msiSecret, SPN from secret
1 parent 07f79d4 commit 5432180

File tree

2 files changed

+83
-23
lines changed

2 files changed

+83
-23
lines changed

‎pkg/blob/blob.go

+34-15
Original file line numberDiff line numberDiff line change
@@ -88,6 +88,9 @@ const (
8888
trueValue = "true"
8989
defaultSecretAccountName = "azurestorageaccountname"
9090
defaultSecretAccountKey = "azurestorageaccountkey"
91+
accountSasTokenField = "azurestorageaccountsastoken"
92+
msiSecretField = "msisecret"
93+
storageSPNClientSecretField = "azurestoragespnclientsecret"
9194
Fuse = "fuse"
9295
Fuse2 = "fuse2"
9396
NFS = "nfs"
@@ -364,6 +367,8 @@ func (d *Driver) GetAuthEnv(ctx context.Context, volumeID, protocol string, attr
364367
subsID string
365368
accountKey string
366369
accountSasToken string
370+
msiSecret string
371+
storageSPNClientSecret string
367372
secretName string
368373
pvcNamespace string
369374
keyVaultURL string
@@ -460,7 +465,7 @@ func (d *Driver) GetAuthEnv(ctx context.Context, volumeID, protocol string, attr
460465
if secretName != "" && !strings.EqualFold(azureStorageAuthType, "msi") {
461466
// read from k8s secret first
462467
var name string
463-
name, accountKey, err = d.GetStorageAccountFromSecret(secretName, secretNamespace)
468+
name, accountKey, accountSasToken, msiSecret, storageSPNClientSecret, err = d.GetInfoFromSecret(secretName, secretNamespace)
464469
if name != "" {
465470
accountName = name
466471
}
@@ -485,12 +490,12 @@ func (d *Driver) GetAuthEnv(ctx context.Context, volumeID, protocol string, attr
485490
accountKey = v
486491
case defaultSecretAccountKey: // for compatibility with built-in blobfuse plugin
487492
accountKey = v
488-
case "azurestorageaccountsastoken":
493+
case accountSasTokenField:
489494
accountSasToken = v
490-
case "msisecret":
491-
authEnv = append(authEnv, "MSI_SECRET="+v)
492-
case "azurestoragespnclientsecret":
493-
authEnv = append(authEnv, "AZURE_STORAGE_SPN_CLIENT_SECRET="+v)
495+
case msiSecretField:
496+
msiSecret = v
497+
case storageSPNClientSecretField:
498+
storageSPNClientSecret = v
494499
}
495500
}
496501
}
@@ -500,12 +505,23 @@ func (d *Driver) GetAuthEnv(ctx context.Context, volumeID, protocol string, attr
500505
err = fmt.Errorf("could not find containerName from attributes(%v) or volumeID(%v)", attrib, volumeID)
501506
}
502507

508+
if accountKey != "" {
509+
authEnv = append(authEnv, "AZURE_STORAGE_ACCESS_KEY="+accountKey)
510+
}
511+
503512
if accountSasToken != "" {
513+
klog.V(2).Infof("accountSasToken is not empty, use it to access storage account(%s), container(%s)", accountName, containerName)
504514
authEnv = append(authEnv, "AZURE_STORAGE_SAS_TOKEN="+accountSasToken)
505515
}
506516

507-
if accountKey != "" {
508-
authEnv = append(authEnv, "AZURE_STORAGE_ACCESS_KEY="+accountKey)
517+
if msiSecret != "" {
518+
klog.V(2).Infof("msiSecret is not empty, use it to access storage account(%s), container(%s)", accountName, containerName)
519+
authEnv = append(authEnv, "MSI_SECRET="+msiSecret)
520+
}
521+
522+
if storageSPNClientSecret != "" {
523+
klog.V(2).Infof("storageSPNClientSecret is not empty, use it to access storage account(%s), container(%s)", accountName, containerName)
524+
authEnv = append(authEnv, "AZURE_STORAGE_SPN_CLIENT_SECRET="+storageSPNClientSecret)
509525
}
510526

511527
return rgName, accountName, accountKey, containerName, authEnv, err
@@ -738,31 +754,34 @@ func (d *Driver) GetStorageAccesskey(ctx context.Context, accountOptions *azure.
738754
if secretName == "" {
739755
secretName = fmt.Sprintf(secretNameTemplate, accountOptions.Name)
740756
}
741-
_, accountKey, err := d.GetStorageAccountFromSecret(secretName, secretNamespace)
757+
_, accountKey, _, _, _, err := d.GetInfoFromSecret(secretName, secretNamespace)
742758
if err != nil {
743759
klog.V(2).Infof("could not get account(%s) key from secret(%s) namespace(%s), error: %v, use cluster identity to get account key instead", accountOptions.Name, secretName, secretNamespace, err)
744760
accountKey, err = d.cloud.GetStorageAccesskey(ctx, accountOptions.SubscriptionID, accountOptions.Name, accountOptions.ResourceGroup)
745761
}
746762
return accountOptions.Name, accountKey, err
747763
}
748764

749-
// GetStorageAccountFromSecret get storage account key from k8s secret
750-
// return <accountName, accountKey, error>
751-
func (d *Driver) GetStorageAccountFromSecret(secretName, secretNamespace string) (string, string, error) {
765+
// GetInfoFromSecret get info from k8s secret
766+
// return <accountName, accountKey, accountSasToken, msiSecret, spnClientSecret, error>
767+
func (d *Driver) GetInfoFromSecret(secretName, secretNamespace string) (string, string, string, string, string, error) {
752768
if d.cloud.KubeClient == nil {
753-
return "", "", fmt.Errorf("could not get account key from secret(%s): KubeClient is nil", secretName)
769+
return "", "", "", "", "", fmt.Errorf("could not get account key from secret(%s): KubeClient is nil", secretName)
754770
}
755771

756772
secret, err := d.cloud.KubeClient.CoreV1().Secrets(secretNamespace).Get(context.TODO(), secretName, metav1.GetOptions{})
757773
if err != nil {
758-
return "", "", fmt.Errorf("could not get secret(%v): %w", secretName, err)
774+
return "", "", "", "", "", fmt.Errorf("could not get secret(%v): %w", secretName, err)
759775
}
760776

761777
accountName := strings.TrimSpace(string(secret.Data[defaultSecretAccountName][:]))
762778
accountKey := strings.TrimSpace(string(secret.Data[defaultSecretAccountKey][:]))
779+
accountSasToken := strings.TrimSpace(string(secret.Data[accountSasTokenField][:]))
780+
msiSecret := strings.TrimSpace(string(secret.Data[msiSecretField][:]))
781+
spnClientSecret := strings.TrimSpace(string(secret.Data[storageSPNClientSecretField][:]))
763782

764783
klog.V(4).Infof("got storage account(%s) from secret", accountName)
765-
return accountName, accountKey, nil
784+
return accountName, accountKey, accountSasToken, msiSecret, spnClientSecret, nil
766785
}
767786

768787
// getSubnetResourceID get default subnet resource ID from cloud provider config

‎pkg/blob/blob_test.go

+49-8
Original file line numberDiff line numberDiff line change
@@ -1033,7 +1033,7 @@ func TestGetStorageAccesskey(t *testing.T) {
10331033
}
10341034
}
10351035

1036-
func TestGetStorageAccountFromSecret(t *testing.T) {
1036+
func TestGetInfoFromSecret(t *testing.T) {
10371037
fakeClient := fake.NewSimpleClientset()
10381038
testCases := []struct {
10391039
name string
@@ -1047,7 +1047,7 @@ func TestGetStorageAccountFromSecret(t *testing.T) {
10471047
d.cloud.KubeClient = nil
10481048
secretName := "foo"
10491049
secretNamespace := "bar"
1050-
_, _, err := d.GetStorageAccountFromSecret(secretName, secretNamespace)
1050+
_, _, _, _, _, err := d.GetInfoFromSecret(secretName, secretNamespace)
10511051
expectedErr := fmt.Errorf("could not get account key from secret(%s): KubeClient is nil", secretName)
10521052
if assert.Error(t, err) {
10531053
assert.Equal(t, expectedErr, err)
@@ -1062,7 +1062,7 @@ func TestGetStorageAccountFromSecret(t *testing.T) {
10621062
d.cloud.KubeClient = fakeClient
10631063
secretName := ""
10641064
secretNamespace := ""
1065-
_, _, err := d.GetStorageAccountFromSecret(secretName, secretNamespace)
1065+
_, _, _, _, _, err := d.GetInfoFromSecret(secretName, secretNamespace)
10661066
// expectedErr := fmt.Errorf("could not get secret(%v): %w", secretName, err)
10671067
assert.Error(t, err) // could not check what type of error, needs fix
10681068
/*if assert.Error(t, err) {
@@ -1071,12 +1071,12 @@ func TestGetStorageAccountFromSecret(t *testing.T) {
10711071
},
10721072
},
10731073
{
1074-
name: "Successful Input",
1074+
name: "get account name from secret",
10751075
testFunc: func(t *testing.T) {
10761076
d := NewFakeDriver()
10771077
d.cloud = &azure.Cloud{}
10781078
d.cloud.KubeClient = fakeClient
1079-
secretName := "john smith"
1079+
secretName := "store_account_name_key"
10801080
secretNamespace := "namespace"
10811081
accountName := "bar"
10821082
accountKey := "foo"
@@ -1095,9 +1095,50 @@ func TestGetStorageAccountFromSecret(t *testing.T) {
10951095
if secretCreateErr != nil {
10961096
t.Error("failed to create secret")
10971097
}
1098-
an, ak, err := d.GetStorageAccountFromSecret(secretName, secretNamespace)
1099-
assert.Equal(t, accountName, an, "accountName's should match")
1100-
assert.Equal(t, accountKey, ak, "accountKey's should match")
1098+
an, ak, accountSasToken, msiSecret, storageSPNClientSecret, err := d.GetInfoFromSecret(secretName, secretNamespace)
1099+
assert.Equal(t, accountName, an, "accountName should match")
1100+
assert.Equal(t, accountKey, ak, "accountKey should match")
1101+
assert.Equal(t, "", accountSasToken, "accountSasToken should be empty")
1102+
assert.Equal(t, "", msiSecret, "msiSecret should be empty")
1103+
assert.Equal(t, "", storageSPNClientSecret, "storageSPNClientSecret should be empty")
1104+
assert.Equal(t, nil, err, "error should be nil")
1105+
},
1106+
},
1107+
{
1108+
name: "get other info from secret",
1109+
testFunc: func(t *testing.T) {
1110+
d := NewFakeDriver()
1111+
d.cloud = &azure.Cloud{}
1112+
d.cloud.KubeClient = fakeClient
1113+
secretName := "store_other_info"
1114+
secretNamespace := "namespace"
1115+
accountName := "bar"
1116+
accountSasTokenValue := "foo"
1117+
msiSecretValue := "msiSecret"
1118+
storageSPNClientSecretValue := "storageSPNClientSecret"
1119+
secret := &v1api.Secret{
1120+
ObjectMeta: metav1.ObjectMeta{
1121+
Namespace: secretNamespace,
1122+
Name: secretName,
1123+
},
1124+
Data: map[string][]byte{
1125+
defaultSecretAccountName: []byte(accountName),
1126+
accountSasTokenField: []byte(accountSasTokenValue),
1127+
msiSecretField: []byte(msiSecretValue),
1128+
storageSPNClientSecretField: []byte(storageSPNClientSecretValue),
1129+
},
1130+
Type: "Opaque",
1131+
}
1132+
_, secretCreateErr := d.cloud.KubeClient.CoreV1().Secrets(secretNamespace).Create(context.TODO(), secret, metav1.CreateOptions{})
1133+
if secretCreateErr != nil {
1134+
t.Error("failed to create secret")
1135+
}
1136+
an, ak, accountSasToken, msiSecret, storageSPNClientSecret, err := d.GetInfoFromSecret(secretName, secretNamespace)
1137+
assert.Equal(t, accountName, an, "accountName should match")
1138+
assert.Equal(t, "", ak, "accountKey should be empty")
1139+
assert.Equal(t, accountSasTokenValue, accountSasToken, "sasToken should match")
1140+
assert.Equal(t, msiSecretValue, msiSecret, "msiSecret should match")
1141+
assert.Equal(t, storageSPNClientSecretValue, storageSPNClientSecret, "storageSPNClientSecret should match")
11011142
assert.Equal(t, nil, err, "error should be nil")
11021143
},
11031144
},

0 commit comments

Comments
 (0)