kubernetes-sigs / cloud-provider-azure / 33169172181
77%
master: 80%

LAST BUILD BRANCH: release-1.35
DEFAULT BRANCH: master
Ran
Jobs 1
Files 96
Run time 1min
Badge
Embed ▾
README BADGES
x

If you need to use a raster PNG badge, change the '.svg' to '.png' in the link

Markdown

Textile

RDoc

HTML

Rst
coverage: 75.622% (-0.02%) from 75.646%
33169172181

push

github

web-flow 
[release-1.35] fix: pass cloud config in GetStorageAccesskeyFromServiceAccountToken (sovereign cloud WI) (#10905)

* fix: pass cloud config when using workload identity to get storage account key

GetStorageAccesskeyFromServiceAccountToken always constructed the client
assertion credential and the storage account ARM client with default
(Azure Public) cloud settings. In sovereign clouds (AzureChinaCloud,
AzureUSGovernmentCloud, AzureStackCloud) this caused AAD to reject the
federated token exchange with AADSTS500011 because the requested
resource audience did not match the sovereign ARM endpoint.

Derive the azcore ClientOptions from az.ARMClientConfig via
azclient.GetAzCoreClientOption so both the ClientAssertionCredential
and the accountclient use the correct Cloud (AAD authority + ARM
audience). This makes blob-csi-driver / azurefile-csi-driver storage
account key retrieval via workload identity work in non-Public clouds.

Fixes kubernetes-sigs/blob-csi-driver#2649

Signed-off-by: Andy Zhang <xiazhang@microsoft.com>

* test(storage): regression tests for cloud selection in GetStorageAccesskeyFromServiceAccountToken

Extract the azcore/arm client-options assembly out of
GetStorageAccesskeyFromServiceAccountToken into a small helper
(buildSATokenClientOptions) so the cloud-selection behavior can be
covered by unit tests without a live ARM endpoint.

Add TestBuildSATokenClientOptions_CloudSelection to pin the AAD
authority host and ARM ResourceManager endpoint per cloud for
AzurePublic, AzureChinaCloud, and AzureUSGovernmentCloud, plus a
nil-config default case. These would have failed against the pre-fix
code that ignored az.ARMClientConfig and let azidentity/arm default to
Azure Public — the exact path that caused AADSTS500011 in
kubernetes-sigs/blob-csi-driver#2649.

No behavior change in the refactor.

Signed-off-by: Andy Zhang <xiazhang@microsoft.com>

* test(storage): gofmt fix for satoken test

Signed-off-by: Andy Zhang <xiazhang@microsoft.com>... (continued)

14791 of 19559 relevant lines covered (75.62%)

839.92 hits per line

Coverage Regressions

Lines Coverage ∆ File
214
71.22
-0.61% provider/storage/azure_storageaccount.go
Jobs
ID Job ID Ran Files Coverage
1 33169172181.1 96
75.62
GitHub Action Run
Source Files on build 33169172181