Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Support Azure resource ID as userAssignedIdentityID #1290

Merged
merged 1 commit into from
Mar 29, 2022
+62 −2
Merged

Support Azure resource ID as userAssignedIdentityID #1290

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
11 changes: 11 additions & 0 deletions pkg/auth/azure_auth.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -100,6 +100,17 @@ func GetServicePrincipalToken(config *AzureAuthConfig, env *azure.Environment, r
}
if len(config.UserAssignedIdentityID) > 0 {
klog.V(4).Info("azure: using User Assigned MSI ID to retrieve access token")
resourceID, err := azure.ParseResourceID(config.UserAssignedIdentityID)
if err == nil &&
strings.EqualFold(resourceID.Provider, "Microsoft.ManagedIdentity") &&
strings.EqualFold(resourceID.ResourceType, "userAssignedIdentities") {
klog.V(4).Info("azure: User Assigned MSI ID is resource ID")
return adal.NewServicePrincipalTokenFromMSIWithIdentityResourceID(msiEndpoint,
resource,
config.UserAssignedIdentityID)
}

klog.V(4).Info("azure: User Assigned MSI ID is client ID. Resource ID parsing error: %+v", err)
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Hi @ArchangelSDY , I got this error now, from current code logic, looks like it's just an info log, I think we need to refine the logging, otherwise there will be following error as long as User Assigned MSI ID is client ID

[pod/csi-blob-node-8trh8/blob] I0812 03:15:51.934107       1 azure_auth.go:245] Using AzurePublicCloud environment
[pod/csi-blob-node-8trh8/blob] I0812 03:15:51.934127       1 azure_auth.go:96] azure: using managed identity extension to retrieve access token
[pod/csi-blob-node-8trh8/blob] I0812 03:15:51.934131       1 azure_auth.go:102] azure: using User Assigned MSI ID to retrieve access token
[pod/csi-blob-node-8trh8/blob] I0812 03:15:51.934162       1 azure_auth.go:113] azure: User Assigned MSI ID is client ID. Resource ID parsing error: %+vparsing failed for 82e9bd91-c283-4b2d-8708-6d11b07d630d. Invalid resource Id format

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

anyway, let me refine the logging to fix this error msg

return adal.NewServicePrincipalTokenFromMSIWithUserAssignedID(msiEndpoint,
resource,
config.UserAssignedIdentityID)
Expand Down
53 changes: 51 additions & 2 deletions pkg/auth/azure_auth_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -65,13 +65,13 @@ func TestGetServicePrincipalTokenFromMSIWithUserAssignedID(t *testing.T) {
configs := []*AzureAuthConfig{
{
UseManagedIdentityExtension: true,
UserAssignedIdentityID: "UserAssignedIdentityID",
UserAssignedIdentityID: "00000000-0000-0000-0000-000000000000",
},
// The Azure service principal is ignored when
// UseManagedIdentityExtension is set to true
{
UseManagedIdentityExtension: true,
UserAssignedIdentityID: "UserAssignedIdentityID",
UserAssignedIdentityID: "00000000-0000-0000-0000-000000000000",
TenantID: "TenantID",
AADClientID: "AADClientID",
AADClientSecret: "AADClientSecret",
Expand Down Expand Up @@ -110,6 +110,55 @@ func TestGetServicePrincipalTokenFromMSIWithUserAssignedID(t *testing.T) {
}
}

func TestGetServicePrincipalTokenFromMSIWithIdentityResourceID(t *testing.T) {
configs := []*AzureAuthConfig{
{
UseManagedIdentityExtension: true,
UserAssignedIdentityID: "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg/providers/Microsoft.ManagedIdentity/userAssignedIdentities/ua",
},
// The Azure service principal is ignored when
// UseManagedIdentityExtension is set to true
{
UseManagedIdentityExtension: true,
UserAssignedIdentityID: "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg/providers/Microsoft.ManagedIdentity/userAssignedIdentities/ua",
TenantID: "TenantID",
AADClientID: "AADClientID",
AADClientSecret: "AADClientSecret",
},
}
env := &azure.PublicCloud

// msiEndpointEnv and msiSecretEnv are required because autorest/adal library requires IMDS endpoint to be available.
server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
assert.Equal(t, "GET", r.Method)
w.WriteHeader(http.StatusOK)
_, err := w.Write([]byte("{}"))
assert.NoError(t, err)
}))
originalEnv := os.Getenv(msiEndpointEnv)
originalSecret := os.Getenv(msiSecretEnv)
os.Setenv(msiEndpointEnv, server.URL)
os.Setenv(msiSecretEnv, "secret")
defer func() {
server.Close()
os.Setenv(msiEndpointEnv, originalEnv)
os.Setenv(msiSecretEnv, originalSecret)
}()

for _, config := range configs {
token, err := GetServicePrincipalToken(config, env, "")
assert.NoError(t, err)

msiEndpoint, err := adal.GetMSIVMEndpoint()
assert.NoError(t, err)

spt, err := adal.NewServicePrincipalTokenFromMSIWithIdentityResourceID(msiEndpoint,
env.ServiceManagementEndpoint, config.UserAssignedIdentityID)
assert.NoError(t, err)
assert.Equal(t, token, spt)
}
}

func TestGetServicePrincipalTokenFromMSI(t *testing.T) {
configs := []*AzureAuthConfig{
{
Expand Down