From dffc903272757c2e4778e428ee4ca319bac8ea5a Mon Sep 17 00:00:00 2001 From: DylanGuedes Date: Tue, 14 Jan 2025 08:12:40 -0300 Subject: [PATCH] Re-implement the flags with signed-off. Signed-off-by: DylanGuedes --- CHANGELOG.md | 1 + providers/azure/azure.go | 11 +++++++++++ providers/azure/azure_test.go | 21 +++++++++++++++++++++ providers/azure/helpers.go | 26 +++++++++++++++----------- 4 files changed, 48 insertions(+), 11 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index a7555030..8e3d802c 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -11,6 +11,7 @@ We use *breaking :warning:* to mark changes that are not backward compatible (re ## Unreleased - [#38](https://github.com/thanos-io/objstore/pull/38) GCS: Upgrade cloud.google.com/go/storage version to `v1.43.0`. - [#145](https://github.com/thanos-io/objstore/pull/145) Include content length in the response of Get and GetRange. +- [#157](https://github.com/thanos-io/objstore/pull/157) Azure: Add `az_tenant_id`, `client_id` and `client_secret` configs. ### Fixed - [#153](https://github.com/thanos-io/objstore/pull/153) Metrics: Fix `objstore_bucket_operation_duration_seconds_*` for `get` and `get_range` operations. diff --git a/providers/azure/azure.go b/providers/azure/azure.go index 8d055e77..05fbdb55 100644 --- a/providers/azure/azure.go +++ b/providers/azure/azure.go @@ -46,6 +46,9 @@ var DefaultConfig = Config{ // Config Azure storage configuration. type Config struct { + AzTenantID string `yaml:"az_tenant_id"` + ClientID string `yaml:"client_id"` + ClientSecret string `yaml:"client_secret"` StorageAccountName string `yaml:"storage_account"` StorageAccountKey string `yaml:"storage_account_key"` StorageConnectionString string `yaml:"storage_connection_string"` @@ -84,6 +87,14 @@ func (conf *Config) validate() error { errMsg = append(errMsg, "user_assigned_id cannot be set when using storage_connection_string authentication") } + if conf.UserAssignedID != "" && conf.ClientID != "" { + errMsg = append(errMsg, "user_assigned_id cannot be set when using client_id authentication") + } + + if (conf.AzTenantID != "" || conf.ClientSecret != "" || conf.ClientID != "") && (conf.AzTenantID == "" || conf.ClientSecret == "" || conf.ClientID == "") { + errMsg = append(errMsg, "az_tenant_id, client_id, and client_secret must be set together") + } + if conf.StorageAccountKey != "" && conf.StorageConnectionString != "" { errMsg = append(errMsg, "storage_account_key and storage_connection_string cannot both be set") } diff --git a/providers/azure/azure_test.go b/providers/azure/azure_test.go index a96dcefb..bee65d26 100644 --- a/providers/azure/azure_test.go +++ b/providers/azure/azure_test.go @@ -140,6 +140,27 @@ container: "MyContainer"`), storage_account_key: "" user_assigned_id: "1234-56578678-655" storage_connection_string: "myConnectionString" +container: "MyContainer"`), + wantFailParse: false, + wantFailValidate: true, + }, + { + name: "Valid AzTenantID, ClientID, ClientSecret", + config: []byte(`storage_account: "myAccount" +storage_account_key: "" +az_tenant_id: "1234-56578678-655" +client_id: "1234-56578678-655" +client_secret: "1234-56578678-655" +container: "MyContainer"`), + wantFailParse: false, + wantFailValidate: false, + }, + { + name: "Valid ClientID and ClientSecret but missing AzTenantID", + config: []byte(`storage_account: "myAccount" +storage_account_key: "" +client_id: "1234-56578678-655" +client_secret: "1234-56578678-655" container: "MyContainer"`), wantFailParse: false, wantFailValidate: true, diff --git a/providers/azure/helpers.go b/providers/azure/helpers.go index deb86d03..0b76ddb3 100644 --- a/providers/azure/helpers.go +++ b/providers/azure/helpers.go @@ -71,17 +71,7 @@ func getContainerClient(conf Config, wrapRoundtripper func(http.RoundTripper) ht } // Otherwise use a token credential - var cred azcore.TokenCredential - - // Use Managed Identity Credential if a user assigned ID is set - if conf.UserAssignedID != "" { - msiOpt := &azidentity.ManagedIdentityCredentialOptions{} - msiOpt.ID = azidentity.ClientID(conf.UserAssignedID) - cred, err = azidentity.NewManagedIdentityCredential(msiOpt) - } else { - // Otherwise use Default Azure Credential - cred, err = azidentity.NewDefaultAzureCredential(nil) - } + cred, err := getTokenCredential(conf) if err != nil { return nil, err @@ -94,3 +84,17 @@ func getContainerClient(conf Config, wrapRoundtripper func(http.RoundTripper) ht return containerClient, nil } + +func getTokenCredential(conf Config) (azcore.TokenCredential, error) { + if conf.ClientSecret != "" && conf.AzTenantID != "" && conf.ClientID != "" { + return azidentity.NewClientSecretCredential(conf.AzTenantID, conf.ClientID, conf.ClientSecret, &azidentity.ClientSecretCredentialOptions{}) + } + + if conf.UserAssignedID == "" { + return azidentity.NewDefaultAzureCredential(nil) + } + + msiOpt := &azidentity.ManagedIdentityCredentialOptions{} + msiOpt.ID = azidentity.ClientID(conf.UserAssignedID) + return azidentity.NewManagedIdentityCredential(msiOpt) +}