kubernetes-sigs / cloud-provider-azure / 33169173028
80%
master: 79%

LAST BUILD BRANCH: fix/imds-externalip-preservation
DEFAULT BRANCH: master
Ran
Jobs 1
Files 115
Run time 1min
Badge
Embed ▾
README BADGES
x

If you need to use a raster PNG badge, change the '.svg' to '.png' in the link

Markdown

Textile

RDoc

HTML

Rst
coverage: 79.569% (-0.04%) from 79.612%
33169173028

push

github

web-flow 
[release-1.36] fix: pass cloud config in GetStorageAccesskeyFromServiceAccountToken (sovereign cloud WI) (#10904)

* fix: pass cloud config when using workload identity to get storage account key

GetStorageAccesskeyFromServiceAccountToken always constructed the client
assertion credential and the storage account ARM client with default
(Azure Public) cloud settings. In sovereign clouds (AzureChinaCloud,
AzureUSGovernmentCloud, AzureStackCloud) this caused AAD to reject the
federated token exchange with AADSTS500011 because the requested
resource audience did not match the sovereign ARM endpoint.

Derive the azcore ClientOptions from az.ARMClientConfig via
azclient.GetAzCoreClientOption so both the ClientAssertionCredential
and the accountclient use the correct Cloud (AAD authority + ARM
audience). This makes blob-csi-driver / azurefile-csi-driver storage
account key retrieval via workload identity work in non-Public clouds.

Fixes kubernetes-sigs/blob-csi-driver#2649

Signed-off-by: Andy Zhang <xiazhang@microsoft.com>

* test(storage): regression tests for cloud selection in GetStorageAccesskeyFromServiceAccountToken

Extract the azcore/arm client-options assembly out of
GetStorageAccesskeyFromServiceAccountToken into a small helper
(buildSATokenClientOptions) so the cloud-selection behavior can be
covered by unit tests without a live ARM endpoint.

Add TestBuildSATokenClientOptions_CloudSelection to pin the AAD
authority host and ARM ResourceManager endpoint per cloud for
AzurePublic, AzureChinaCloud, and AzureUSGovernmentCloud, plus a
nil-config default case. These would have failed against the pre-fix
code that ignored az.ARMClientConfig and let azidentity/arm default to
Azure Public — the exact path that caused AADSTS500011 in
kubernetes-sigs/blob-csi-driver#2649.

No behavior change in the refactor.

Signed-off-by: Andy Zhang <xiazhang@microsoft.com>

* test(storage): gofmt fix for satoken test

Signed-off-by: Andy Zhang <xiazhang@microsoft.com>... (continued)

21342 of 26822 relevant lines covered (79.57%)

1645.42 hits per line

Coverage Regressions

Lines Coverage ∆ File
214
71.22
-0.61% provider/storage/azure_storageaccount.go
4
93.7
-0.23% provider/servicegateway/difftracker/engine.go
Jobs
ID Job ID Ran Files Coverage
1 33169173028.1 115
79.57
GitHub Action Run
Source Files on build 33169173028