Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Upgrade storage client & support Entra identities for storage in more scenarios #3573

Open
wants to merge 2 commits into
base: main
Choose a base branch
from

Conversation

aelij
Copy link
Member

@aelij aelij commented Jan 17, 2024

Issue describing the changes in this PR

Resolves #3376

Pull request checklist

  • My changes do not require documentation changes
    • Otherwise: Documentation issue linked to PR
  • My changes do not need to be backported to a previous version
    • Otherwise: Backport tracked by issue/PR #issue_or_pr
  • I have added all required tests (Unit tests, E2E tests)

PR overview:

  • Upgrade to the latest Storage client
  • Use AzureCliCredential and AzurePowerShellCredential to fetch an access token instead of the code that calls the CLIs
    • Note I intentionally did not use DefaultAzureCredential to preserve the current behavior, as it might require the user to specify a tenant ID under certain conditions
  • Support AzureWebJobsStorage__accountName in more scenarios:
    • Linux Consumption - fetches the storage account key using ARG+ARM and uses it to create the required SAS URI
    • Linux Elastic - combined code with Dedicated, as both support run from package
  • Remove old unused app.config (.NET Framework relic)

Copy link

@xanecs xanecs left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Hi, I've tried your fork and with a few minor exceptions, it worked perfectly and solved my deployment problem. Thank you!

There are just two small changes I've made to allow working with a Storage Account that has Shared Keys turned off.

{
var storageAccount = await ArmClient.FindStorageAccount(accountName);
blobContainerClient = new BlobContainerClient(new UriBuilder(storageAccount.Properties.PrimaryEndpoints.Blob) { Path = containerName }.Uri,
new Storage.StorageSharedKeyCredential(accountName, storageAccount.Key.Value));
Copy link

@xanecs xanecs Feb 23, 2024

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Remove the StorageSharedKeyCredential and use this.Credential instead.
This allows disabling Shared Keys on the storage account altogether.


return blob.Uri + blobToken;
return blob.GenerateSasUri(sasConstraints).ToString();
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Again, to allow disabling Shared Keys on the storage account, return blob.Uri in case managed identity is used.

@mattchenderson mattchenderson self-assigned this Jul 10, 2024
@aishwaryabh aishwaryabh changed the base branch from v4.x to main November 26, 2024 20:25
@aishwaryabh aishwaryabh requested review from a team as code owners November 26, 2024 20:25
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

Cannot publish when identity-based storage connection is used (AzureWebJobsStorage__accountName)
3 participants