when msi is enabled, use a msi authorizer to fetch the storage accoun…

docs/configuration/config-file-reference.md

@@ -1240,6 +1240,18 @@ storage:
     # CLI flag: -ruler.storage.azure.environment
     [environment: <string> | default = "AzureGlobal"]
 
+    # Resource management uri
+    # CLI flag: -ruler.storage.azure.msi-resource
+    [msi_resource: <string> | default = ""]
+
+    # Name of the resource group which the storage account belongs to
+    # CLI flag: -ruler.storage.azure.resource-group-name
+    [resource_group_name: <string> | default = ""]
+
+    # The Microsoft Azure subscription id
+    # CLI flag: -ruler.storage.azure.subscription-id
+    [subscription_id: <string> | default = ""]
+
     # Name of the blob container used to store chunks. This container must be
     # created before running cortex.
     # CLI flag: -ruler.storage.azure.container-name
@@ -1948,6 +1960,18 @@ storage:
     # CLI flag: -alertmanager.storage.azure.environment
     [environment: <string> | default = "AzureGlobal"]
 
+    # Resource management uri
+    # CLI flag: -alertmanager.storage.azure.msi-resource
+    [msi_resource: <string> | default = ""]
+
+    # Name of the resource group which the storage account belongs to
+    # CLI flag: -alertmanager.storage.azure.resource-group-name
+    [resource_group_name: <string> | default = ""]
+
+    # The Microsoft Azure subscription id
+    # CLI flag: -alertmanager.storage.azure.subscription-id
+    [subscription_id: <string> | default = ""]
+
     # Name of the blob container used to store chunks. This container must be
     # created before running cortex.
     # CLI flag: -alertmanager.storage.azure.container-name
@@ -2855,6 +2879,18 @@ azure:
   # CLI flag: -azure.environment
   [environment: <string> | default = "AzureGlobal"]
 
+  # Resource management uri
+  # CLI flag: -azure.msi-resource
+  [msi_resource: <string> | default = ""]
+
+  # Name of the resource group which the storage account belongs to
+  # CLI flag: -azure.resource-group-name
+  [resource_group_name: <string> | default = ""]
+
+  # The Microsoft Azure subscription id
+  # CLI flag: -azure.subscription-id
+  [subscription_id: <string> | default = ""]
+
   # Name of the blob container used to store chunks. This container must be
   # created before running cortex.
   # CLI flag: -azure.container-name

go.mod

@@ -6,7 +6,10 @@ require (
 	cloud.google.com/go/bigtable v1.2.0
 	cloud.google.com/go/storage v1.10.0
 	github.com/Azure/azure-pipeline-go v0.2.2
+	github.com/Azure/azure-sdk-for-go v52.5.0+incompatible
 	github.com/Azure/azure-storage-blob-go v0.8.0
+	github.com/Azure/go-autorest/autorest v0.11.18
+	github.com/Azure/go-autorest/autorest/azure/auth v0.5.7
 	github.com/Masterminds/squirrel v0.0.0-20161115235646-20f192218cf5
 	github.com/NYTimes/gziphandler v1.1.1
 	github.com/alecthomas/units v0.0.0-20210208195552-ff826a37aa15

go.sum

@@ -79,6 +79,7 @@ github.com/Azure/go-autorest/autorest v0.11.2/go.mod h1:JFgpikqFJ/MleTTxwepExTKn
 github.com/Azure/go-autorest/autorest v0.11.4/go.mod h1:JFgpikqFJ/MleTTxwepExTKnFUKKszPS8UavbQYUMuw=
 github.com/Azure/go-autorest/autorest v0.11.10/go.mod h1:eipySxLmqSyC5s5k1CLupqet0PSENBEDP93LQ9a8QYw=
 github.com/Azure/go-autorest/autorest v0.11.11/go.mod h1:eipySxLmqSyC5s5k1CLupqet0PSENBEDP93LQ9a8QYw=
+github.com/Azure/go-autorest/autorest v0.11.17/go.mod h1:eipySxLmqSyC5s5k1CLupqet0PSENBEDP93LQ9a8QYw=
 github.com/Azure/go-autorest/autorest v0.11.18 h1:90Y4srNYrwOtAgVo3ndrQkTYn6kf1Eg/AjTFJ8Is2aM=
 github.com/Azure/go-autorest/autorest v0.11.18/go.mod h1:dSiJPy22c3u0OtOKDNttNgqpNFY/GeWa7GH/Pz56QRA=
 github.com/Azure/go-autorest/autorest/adal v0.5.0/go.mod h1:8Z9fGy2MpX0PvDjB1pEgQTmVqjGhiHBW7RJJEciWzS0=
@@ -88,8 +89,13 @@ github.com/Azure/go-autorest/autorest/adal v0.8.3/go.mod h1:ZjhuQClTqx435SRJ2iMl
 github.com/Azure/go-autorest/autorest/adal v0.9.0/go.mod h1:/c022QCutn2P7uY+/oQWWNcK9YU+MH96NgK+jErpbcg=
 github.com/Azure/go-autorest/autorest/adal v0.9.2/go.mod h1:/3SMAM86bP6wC9Ev35peQDUeqFZBMH07vvUOmg4z/fE=
 github.com/Azure/go-autorest/autorest/adal v0.9.5/go.mod h1:B7KF7jKIeC9Mct5spmyCB/A8CG/sEz1vwIRGv/bbw7A=
+github.com/Azure/go-autorest/autorest/adal v0.9.11/go.mod h1:nBKAnTomx8gDtl+3ZCJv2v0KACFHWTB2drffI1B68Pk=
 github.com/Azure/go-autorest/autorest/adal v0.9.13 h1:Mp5hbtOePIzM8pJVRa3YLrWWmZtoxRXqUEzCfJt3+/Q=
 github.com/Azure/go-autorest/autorest/adal v0.9.13/go.mod h1:W/MM4U6nLxnIskrw4UwWzlHfGjwUS50aOsc/I3yuU8M=
+github.com/Azure/go-autorest/autorest/azure/auth v0.5.7 h1:8DQB8yl7aLQuP+nuR5e2RO6454OvFlSTXXaNHshc16s=
+github.com/Azure/go-autorest/autorest/azure/auth v0.5.7/go.mod h1:AkzUsqkrdmNhfP2i54HqINVQopw0CLDnvHpJ88Zz1eI=
+github.com/Azure/go-autorest/autorest/azure/cli v0.4.2 h1:dMOmEJfkLKW/7JsokJqkyoYSgmR08hi9KrhjZb+JALY=
+github.com/Azure/go-autorest/autorest/azure/cli v0.4.2/go.mod h1:7qkJkT+j6b+hIpzMOwPChJhTqS8VbsqqgULzMNRugoM=
 github.com/Azure/go-autorest/autorest/date v0.1.0/go.mod h1:plvfp3oPSKwf2DNjlBjWF/7vwR+cUD/ELuzDCXwHUVA=
 github.com/Azure/go-autorest/autorest/date v0.2.0/go.mod h1:vcORJHLJEh643/Ioh9+vPmf1Ij9AEBM5FuBIXLmIy0g=
 github.com/Azure/go-autorest/autorest/date v0.3.0 h1:7gUk1U5M/CQbp9WoqinNzJar+8KY+LPI6wiWrP/myHw=
@@ -98,6 +104,7 @@ github.com/Azure/go-autorest/autorest/mocks v0.1.0/go.mod h1:OTyCOPRA2IgIlWxVYxB
 github.com/Azure/go-autorest/autorest/mocks v0.2.0/go.mod h1:OTyCOPRA2IgIlWxVYxBee2F5Gr4kF2zd2J5cFRaIDN0=
 github.com/Azure/go-autorest/autorest/mocks v0.3.0/go.mod h1:a8FDP3DYzQ4RYfVAxAN3SVSiiO77gL2j2ronKKP0syM=
 github.com/Azure/go-autorest/autorest/mocks v0.4.0/go.mod h1:LTp+uSrOhSkaKrUy935gNZuuIPPVsHlr9DSOxSayd+k=
+github.com/Azure/go-autorest/autorest/mocks v0.4.1 h1:K0laFcLE6VLTOwNgSxaGbUcLPuGXlNkbVvq4cW4nIHk=
 github.com/Azure/go-autorest/autorest/mocks v0.4.1/go.mod h1:LTp+uSrOhSkaKrUy935gNZuuIPPVsHlr9DSOxSayd+k=
 github.com/Azure/go-autorest/autorest/to v0.3.0/go.mod h1:MgwOyqaIuKdG4TL/2ywSsIWKAfJfgHDo8ObuUk3t5sA=
 github.com/Azure/go-autorest/autorest/to v0.3.1-0.20191028180845-3492b2aff503/go.mod h1:MgwOyqaIuKdG4TL/2ywSsIWKAfJfgHDo8ObuUk3t5sA=
@@ -333,6 +340,9 @@ github.com/digitalocean/godo v1.46.0/go.mod h1:p7dOjjtSBqCTUksqtA5Fd3uaKs9kyTq2x
 github.com/digitalocean/godo v1.52.0/go.mod h1:p7dOjjtSBqCTUksqtA5Fd3uaKs9kyTq2xcz76ulEJRU=
 github.com/digitalocean/godo v1.57.0/go.mod h1:p7dOjjtSBqCTUksqtA5Fd3uaKs9kyTq2xcz76ulEJRU=
 github.com/digitalocean/godo v1.58.0/go.mod h1:p7dOjjtSBqCTUksqtA5Fd3uaKs9kyTq2xcz76ulEJRU=
+github.com/dimchansky/utfbom v1.1.0/go.mod h1:rO41eb7gLfo8SF1jd9F8HplJm1Fewwi4mQvIirEdv+8=
+github.com/dimchansky/utfbom v1.1.1 h1:vV6w1AhK4VMnhBno/TPVCoK9U/LP0PkLCS9tbxHdi/U=
+github.com/dimchansky/utfbom v1.1.1/go.mod h1:SxdoEBH5qIqFocHMyGOXVAybYJdr71b1Q/j0mACtrfE=
 github.com/digitalocean/godo v1.60.0 h1:o/vimtn/HKtYSakFAAZ59Zc5ASORd41S4z1X7pAXPn8=
 github.com/digitalocean/godo v1.60.0/go.mod h1:p7dOjjtSBqCTUksqtA5Fd3uaKs9kyTq2xcz76ulEJRU=
 github.com/dnaeon/go-vcr v1.0.1/go.mod h1:aBB1+wY4s93YsC3HHjMBMrwTj2R9FHDzUr9KyGc8n1E=

pkg/chunk/azure/blob_storage_client.go

@@ -7,11 +7,16 @@ import (
 	"fmt"
 	"io"
 	"net/url"
+	"os"
 	"strings"
 	"time"
 
 	"github.com/Azure/azure-pipeline-go/pipeline"
+	"github.com/Azure/azure-sdk-for-go/services/storage/mgmt/2021-01-01/storage"
+	"github.com/Azure/azure-sdk-for-go/services/subscription/mgmt/2020-09-01/subscription"
 	"github.com/Azure/azure-storage-blob-go/azblob"
+	"github.com/Azure/go-autorest/autorest/azure"
+	"github.com/Azure/go-autorest/autorest/azure/auth"
 
 	"github.com/cortexproject/cortex/pkg/chunk"
 	chunk_util "github.com/cortexproject/cortex/pkg/chunk/util"
@@ -53,6 +58,9 @@ var (
 // BlobStorageConfig defines the configurable flags that can be defined when using azure blob storage.
 type BlobStorageConfig struct {
 	Environment        string         `yaml:"environment"`
+	MSIResource        string         `yaml:"msi_resource,omitempty"`
+	ResourceGroupName  string         `yaml:"resource_group_name,omitempty"`
+	SubscriptionID     string         `yaml:"subscription_id,omitempty"`
 	ContainerName      string         `yaml:"container_name"`
 	AccountName        string         `yaml:"account_name"`
 	AccountKey         flagext.Secret `yaml:"account_key"`
@@ -73,6 +81,9 @@ func (c *BlobStorageConfig) RegisterFlags(f *flag.FlagSet) {
 // RegisterFlagsWithPrefix adds the flags required to config this to the given FlagSet
 func (c *BlobStorageConfig) RegisterFlagsWithPrefix(prefix string, f *flag.FlagSet) {
 	f.StringVar(&c.Environment, prefix+"azure.environment", azureGlobal, fmt.Sprintf("Azure Cloud environment. Supported values are: %s.", strings.Join(supportedEnvironments, ", ")))
+	f.StringVar(&c.MSIResource, prefix+"azure.msi-resource", "", "Resource management uri")
+	f.StringVar(&c.ResourceGroupName, prefix+"azure.resource-group-name", "", "Name of the resource group which the storage account belongs to")
+	f.StringVar(&c.SubscriptionID, prefix+"azure.subscription-id", "", "The Microsoft Azure subscription id")
 	f.StringVar(&c.ContainerName, prefix+"azure.container-name", "cortex", "Name of the blob container used to store chunks. This container must be created before running cortex.")
 	f.StringVar(&c.AccountName, prefix+"azure.account-name", "", "The Microsoft Azure account name to be used")
 	f.Var(&c.AccountKey, prefix+"azure.account-key", "The Microsoft Azure account key to use.")
@@ -101,6 +112,13 @@ func NewBlobStorage(cfg *BlobStorageConfig) (*BlobStorage, error) {
 	}
 
 	var err error
+	if cfg.MSIResource != "" {
+		_, err = cfg.tryFetchAccountKeyWithMSI()
+		if err != nil {
+			return nil, err
+		}
+	}
+
 	blobStorage.containerURL, err = blobStorage.buildContainerURL()
 	if err != nil {
 		return nil, err
@@ -109,6 +127,72 @@ func NewBlobStorage(cfg *BlobStorageConfig) (*BlobStorage, error) {
 	return blobStorage, nil
 }
 
+func setAzureEnvironment(cfg *BlobStorageConfig) error {
+	if cfg.Environment != "" {
+		switch cfg.Environment {
+		case azureGlobal:
+			return os.Setenv(auth.EnvironmentName, azure.PublicCloud.Name)
+		case azureChinaCloud:
+			return os.Setenv(auth.EnvironmentName, azure.ChinaCloud.Name)
+		case azureGermanCloud:
+			return os.Setenv(auth.EnvironmentName, azure.GermanCloud.Name)
+		case azureUSGovernment:
+			return os.Setenv(auth.EnvironmentName, azure.USGovernmentCloud.Name)
+		default:
+			return errors.New("unsupported azure environment:" + cfg.Environment)
+		}
+	}
+	return nil
+}
+
+func (c *BlobStorageConfig) tryFetchAccountKeyWithMSI() (*BlobStorageConfig, error) {
+	if c.ResourceGroupName == "" {
+		return nil, errors.New("resource group name should be specified while using msi")
+	}
+	msiConfig := auth.NewMSIConfig()
+	msiConfig.Resource = c.MSIResource
+	err := setAzureEnvironment(c)
+	if err != nil {
+		return nil, err
+	}
+	settings, err := auth.GetSettingsFromEnvironment()
+	if err != nil {
+		return nil, err
+	}
+	msiAuthorizer, err := msiConfig.Authorizer()
+	if err != nil {
+		return nil, err
+	}
+	subscriptionIdFromEnv := settings.GetSubscriptionID()
+	if c.SubscriptionID == "" {
+		if subscriptionIdFromEnv != "" {
+			c.SubscriptionID = subscriptionIdFromEnv
+		} else {
+			// try to get subscription id with msi
+			subscriptionClient := subscription.NewSubscriptionsClientWithBaseURI(c.MSIResource)
+			subscriptionClient.Authorizer = msiAuthorizer
+			listResultPage, err := subscriptionClient.List(context.Background())
+			if err != nil {
+				return nil, err
+			}
+			if len(listResultPage.Values()) <= 0 {
+				return nil, errors.New("no access to any subscription")
+			}
+			// use the first subscription by default
+			c.SubscriptionID = *(listResultPage.Values()[0].SubscriptionID)
+		}
+	}
+	accountClient := storage.NewAccountsClientWithBaseURI(settings.Environment.ResourceManagerEndpoint, c.SubscriptionID)
+	accountClient.Authorizer = msiAuthorizer
+	listResult, err := accountClient.ListKeys(context.Background(), c.ResourceGroupName, c.AccountName, storage.Kerb)
+	if err != nil {
+		return nil, err
+	}
+	// pick the first record of account key, the result should be with two keys
+	c.AccountKey = flagext.Secret{Value: *(*listResult.Keys)[0].Value}
+	return c, nil
+}
+
 // Stop is a no op, as there are no background workers with this driver currently
 func (b *BlobStorage) Stop() {}