Skip to content

Commit 3fa9ca0

Browse files
openshift-merge-bot[bot]openshift-merge-bot[bot]
authored
Merge pull request #9851 from rna-afk/azure_user_delegated_sas
OCPBUGS-37587: Sign blob container using user delegated creds
2 parents 423f302 + 8b57f2c commit 3fa9ca0

7 files changed

Lines changed: 264 additions & 134 deletions

File tree

‎data/data/install.openshift.io_installconfigs.yaml‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -5474,6 +5474,12 @@ spec:
54745474
azure:
54755475
description: Azure is the configuration used when installing on Azure.
54765476
properties:
5477+
allowSharedKeyAccess:
5478+
description: |-
5479+
AllowSharedKeyAccess specifies if shared access key should be enabled for the storage account.
5480+
Default value is true.
5481+
Disabling this will require a new permission "Storage Blob Data Contributor" in azure.
5482+
type: boolean
54775483
armEndpoint:
54785484
description: ARMEndpoint is the endpoint for the Azure API when
54795485
installing on Azure Stack.

‎pkg/explain/printer_test.go‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -315,6 +315,11 @@ cluster itself may not include these tags.
315315
}, {
316316
path: []string{"platform", "azure"},
317317
desc: `FIELDS:
318+
allowSharedKeyAccess <boolean>
319+
AllowSharedKeyAccess specifies if shared access key should be enabled for the storage account.
320+
Default value is true.
321+
Disabling this will require a new permission "Storage Blob Data Contributor" in azure.
322+
318323
armEndpoint <string>
319324
ARMEndpoint is the endpoint for the Azure API when installing on Azure Stack.
320325

‎pkg/infrastructure/azure/azure.go‎

Lines changed: 108 additions & 51 deletions
Original file line numberDiff line numberDiff line change
@@ -16,6 +16,8 @@ import (
1616
"github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/compute/armcompute/v4"
1717
"github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/network/armnetwork/v2"
1818
"github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/storage/armstorage"
19+
"github.com/Azure/azure-sdk-for-go/sdk/storage/azblob/sas"
20+
"github.com/Azure/azure-sdk-for-go/sdk/storage/azblob/service"
1921
"github.com/coreos/stream-metadata-go/arch"
2022
"github.com/sirupsen/logrus"
2123
corev1 "k8s.io/api/core/v1"
@@ -104,8 +106,8 @@ func (p *Provider) InfraReady(ctx context.Context, in clusterapi.InfraReadyInput
104106
installConfig := in.InstallConfig.Config
105107
platform := installConfig.Platform.Azure
106108
subscriptionID := session.Credentials.SubscriptionID
107-
cloudConfiguration := session.CloudConfig
108-
tokenCredential := session.TokenCreds
109+
p.CloudConfiguration = session.CloudConfig
110+
p.TokenCredential = session.TokenCreds
109111
p.ResourceGroupName = platform.ClusterResourceGroupName(in.InfraID)
110112

111113
userTags := platform.UserTags
@@ -118,15 +120,15 @@ func (p *Provider) InfraReady(ctx context.Context, in clusterapi.InfraReadyInput
118120

119121
opts := &arm.ClientOptions{
120122
ClientOptions: policy.ClientOptions{
121-
Cloud: cloudConfiguration,
123+
Cloud: p.CloudConfiguration,
122124
},
123125
}
124126
computeClientOpts := opts
125127
if platform.CloudName == aztypes.StackCloud {
126128
opts.APIVersion = stackAPIVersion
127129
computeClientOpts = &arm.ClientOptions{
128130
ClientOptions: policy.ClientOptions{
129-
Cloud: cloudConfiguration,
131+
Cloud: p.CloudConfiguration,
130132
APIVersion: stackComputeAPIVersion,
131133
},
132134
}
@@ -139,7 +141,7 @@ func (p *Provider) InfraReady(ctx context.Context, in clusterapi.InfraReadyInput
139141
region: platform.Region,
140142
resourceGroupName: p.ResourceGroupName,
141143
subscriptionID: subscriptionID,
142-
tokenCredential: tokenCredential,
144+
tokenCredential: p.TokenCredential,
143145
infraID: in.InfraID,
144146
clientOpts: p.clientOptions,
145147
tags: p.Tags,
@@ -153,7 +155,7 @@ func (p *Provider) InfraReady(ctx context.Context, in clusterapi.InfraReadyInput
153155

154156
// Creating a dummy nsg for existing vnets installation to appease the ingress operator.
155157
if in.InstallConfig.Config.Azure.VirtualNetwork != "" {
156-
networkClientFactory, err := armnetwork.NewClientFactory(subscriptionID, tokenCredential, p.clientOptions)
158+
networkClientFactory, err := armnetwork.NewClientFactory(subscriptionID, p.TokenCredential, p.clientOptions)
157159
if err != nil {
158160
return fmt.Errorf("failed to create azure network factory: %w", err)
159161
}
@@ -229,20 +231,26 @@ func (p *Provider) InfraReady(ctx context.Context, in clusterapi.InfraReadyInput
229231
var storageClientFactory *armstorage.ClientFactory
230232
var storageAccountKeys []armstorage.AccountKey
231233

234+
sharedKey := true
235+
if in.InstallConfig.Config.Azure.AllowSharedKeyAccess != nil {
236+
sharedKey = *in.InstallConfig.Config.Azure.AllowSharedKeyAccess
237+
}
238+
232239
var createStorageAccountOutput *CreateStorageAccountOutput
233240
if platform.CloudName != aztypes.StackCloud {
234241
// Create storage account
235242
createStorageAccountOutput, err = CreateStorageAccount(ctx, &CreateStorageAccountInput{
236-
SubscriptionID: subscriptionID,
237-
ResourceGroupName: resourceGroupName,
238-
StorageAccountName: storageAccountName,
239-
CloudName: platform.CloudName,
240-
Region: platform.Region,
241-
AuthType: session.AuthType,
242-
Tags: tags,
243-
CustomerManagedKey: platform.CustomerManagedKey,
244-
TokenCredential: tokenCredential,
245-
ClientOpts: p.clientOptions,
243+
SubscriptionID: subscriptionID,
244+
ResourceGroupName: resourceGroupName,
245+
StorageAccountName: storageAccountName,
246+
CloudName: platform.CloudName,
247+
Region: platform.Region,
248+
AuthType: session.AuthType,
249+
AllowSharedKeyAccess: sharedKey,
250+
Tags: tags,
251+
CustomerManagedKey: platform.CustomerManagedKey,
252+
TokenCredential: p.TokenCredential,
253+
ClientOpts: p.clientOptions,
246254
})
247255
if err != nil {
248256
return err
@@ -275,13 +283,16 @@ func (p *Provider) InfraReady(ctx context.Context, in clusterapi.InfraReadyInput
275283
logrus.Debugf("BlobContainer.ID=%s", *blobContainer.ID)
276284

277285
_, err = CreatePageBlob(ctx, &CreatePageBlobInput{
278-
StorageURL: storageURL,
279-
BlobURL: blobURL,
280-
ImageURL: imageURL,
281-
ImageLength: imageLength,
282-
StorageAccountName: storageAccountName,
283-
StorageAccountKeys: storageAccountKeys,
284-
ClientOpts: p.clientOptions,
286+
StorageURL: storageURL,
287+
BlobURL: blobURL,
288+
ImageURL: imageURL,
289+
ImageLength: imageLength,
290+
CloudEnvironment: in.InstallConfig.Azure.CloudName,
291+
AllowSharedKeyAccess: sharedKey,
292+
TokenCredential: session.TokenCreds,
293+
StorageAccountName: storageAccountName,
294+
StorageAccountKeys: storageAccountKeys,
295+
ClientOpts: p.clientOptions,
285296
})
286297
if err != nil {
287298
return err
@@ -294,7 +305,7 @@ func (p *Provider) InfraReady(ctx context.Context, in clusterapi.InfraReadyInput
294305
GalleryName: galleryName,
295306
Region: platform.Region,
296307
Tags: tags,
297-
TokenCredential: tokenCredential,
308+
TokenCredential: p.TokenCredential,
298309
ClientOpts: p.clientOptions,
299310
})
300311
if err != nil {
@@ -313,7 +324,7 @@ func (p *Provider) InfraReady(ctx context.Context, in clusterapi.InfraReadyInput
313324
Offer: "rhcos",
314325
SKU: "basic",
315326
Tags: tags,
316-
TokenCredential: tokenCredential,
327+
TokenCredential: p.TokenCredential,
317328
ClientOpts: p.clientOptions,
318329
Architecture: architecture,
319330
OSType: armcompute.OperatingSystemTypesLinux,
@@ -339,7 +350,7 @@ func (p *Provider) InfraReady(ctx context.Context, in clusterapi.InfraReadyInput
339350
Offer: "rhcos-gen2",
340351
SKU: "gen2",
341352
Tags: tags,
342-
TokenCredential: tokenCredential,
353+
TokenCredential: p.TokenCredential,
343354
ClientOpts: p.clientOptions,
344355
Architecture: architecture,
345356
OSType: armcompute.OperatingSystemTypesLinux,
@@ -385,7 +396,7 @@ func (p *Provider) InfraReady(ctx context.Context, in clusterapi.InfraReadyInput
385396
}
386397

387398
if installConfig.Azure.CloudName == aztypes.StackCloud {
388-
client, err := armcompute.NewImagesClient(subscriptionID, tokenCredential, p.computeClientOptions)
399+
client, err := armcompute.NewImagesClient(subscriptionID, p.TokenCredential, p.computeClientOptions)
389400
if err != nil {
390401
return fmt.Errorf("error creating stack managed images client: %w", err)
391402
}
@@ -423,7 +434,6 @@ func (p *Provider) InfraReady(ctx context.Context, in clusterapi.InfraReadyInput
423434
lbClient: lbClient,
424435
tags: p.Tags,
425436
}
426-
427437
intLoadBalancer, err := updateInternalLoadBalancer(ctx, lbInput)
428438
if err != nil {
429439
return fmt.Errorf("failed to update internal load balancer: %w", err)
@@ -756,25 +766,51 @@ func (p Provider) Ignition(ctx context.Context, in clusterapi.IgnitionInput) ([]
756766
}
757767

758768
sasURL := ""
769+
now := time.Now().UTC().Add(-10 * time.Second)
770+
expiry := now.Add(1 * time.Hour)
771+
info := service.KeyInfo{
772+
Start: to.Ptr(now.UTC().Format(sas.TimeFormat)),
773+
Expiry: to.Ptr(expiry.UTC().Format(sas.TimeFormat)),
774+
}
775+
776+
serviceClient, err := service.NewClient(fmt.Sprintf("https://%s.blob.%s/", p.StorageAccountName, session.Environment.StorageEndpointSuffix),
777+
session.TokenCreds,
778+
&service.ClientOptions{
779+
ClientOptions: azcore.ClientOptions{
780+
Cloud: p.CloudConfiguration,
781+
},
782+
},
783+
)
784+
if err != nil {
785+
return nil, fmt.Errorf("failed to create service client: %w", err)
786+
}
787+
788+
sharedKey := true
789+
if in.InstallConfig.Config.Azure.AllowSharedKeyAccess != nil {
790+
sharedKey = *in.InstallConfig.Config.Azure.AllowSharedKeyAccess
791+
}
759792

760793
if in.InstallConfig.Config.Azure.CustomerManagedKey == nil {
761794
logrus.Debugf("Creating a Block Blob for ignition shim")
762795
sasURL, err = CreateBlockBlob(ctx, &CreateBlockBlobInput{
763-
StorageURL: p.StorageURL,
764-
BlobURL: blobURL,
765-
StorageAccountName: p.StorageAccountName,
766-
StorageAccountKeys: p.StorageAccountKeys,
767-
ClientOpts: p.clientOptions,
768-
BootstrapIgnData: ignOutput.UpdatedBootstrapIgn,
769-
CloudEnvironment: in.InstallConfig.Azure.CloudName,
770-
ContainerName: ignitionContainerName,
771-
BlobName: blobName,
772-
StorageSuffix: session.Environment.StorageEndpointSuffix,
773-
ARMEndpoint: in.InstallConfig.Azure.ARMEndpoint,
774-
Session: session,
775-
Region: in.InstallConfig.Config.Azure.Region,
776-
Tags: p.Tags,
777-
ResourceGroupName: p.ResourceGroupName,
796+
StorageURL: p.StorageURL,
797+
BlobURL: blobURL,
798+
AuthType: session.AuthType,
799+
TokenCredential: session.TokenCreds,
800+
StorageAccountName: p.StorageAccountName,
801+
StorageAccountKeys: p.StorageAccountKeys,
802+
AllowSharedKeyAccess: sharedKey,
803+
ClientOpts: p.clientOptions,
804+
BootstrapIgnData: ignOutput.UpdatedBootstrapIgn,
805+
CloudEnvironment: in.InstallConfig.Azure.CloudName,
806+
ContainerName: ignitionContainerName,
807+
BlobName: blobName,
808+
StorageSuffix: session.Environment.StorageEndpointSuffix,
809+
ARMEndpoint: in.InstallConfig.Azure.ARMEndpoint,
810+
Session: session,
811+
Region: in.InstallConfig.Config.Azure.Region,
812+
Tags: p.Tags,
813+
ResourceGroupName: p.ResourceGroupName,
778814
})
779815
if err != nil {
780816
return nil, fmt.Errorf("failed to create BlockBlob for ignition shim: %w", err)
@@ -787,19 +823,40 @@ func (p Provider) Ignition(ctx context.Context, in clusterapi.IgnitionInput) ([]
787823
}
788824

789825
sasURL, err = CreatePageBlob(ctx, &CreatePageBlobInput{
790-
StorageURL: p.StorageURL,
791-
BlobURL: blobURL,
792-
ImageURL: "",
793-
StorageAccountName: p.StorageAccountName,
794-
BootstrapIgnData: ignOutput.UpdatedBootstrapIgn,
795-
ImageLength: lengthBootstrapFile,
796-
StorageAccountKeys: p.StorageAccountKeys,
797-
ClientOpts: p.clientOptions,
826+
StorageURL: p.StorageURL,
827+
BlobURL: blobURL,
828+
ImageURL: "",
829+
CloudEnvironment: in.InstallConfig.Azure.CloudName,
830+
AllowSharedKeyAccess: sharedKey,
831+
TokenCredential: session.TokenCreds,
832+
StorageAccountName: p.StorageAccountName,
833+
BootstrapIgnData: ignOutput.UpdatedBootstrapIgn,
834+
ImageLength: lengthBootstrapFile,
835+
StorageAccountKeys: p.StorageAccountKeys,
836+
ClientOpts: p.clientOptions,
798837
})
799838
if err != nil {
800839
return nil, fmt.Errorf("failed to create PageBlob for ignition shim: %w", err)
801840
}
802841
}
842+
if sasURL == "" && !sharedKey {
843+
udc, err := serviceClient.GetUserDelegationCredential(context.Background(), info, nil)
844+
if err != nil {
845+
return nil, fmt.Errorf("failed to create user delegation credentials: %w", err)
846+
}
847+
sasQueryParams, err := sas.BlobSignatureValues{
848+
Protocol: sas.ProtocolHTTPS,
849+
StartTime: time.Now().UTC().Add(time.Second * -10),
850+
ExpiryTime: time.Now().UTC().Add(1 * time.Hour),
851+
Permissions: to.Ptr(sas.ContainerPermissions{Read: true}).String(),
852+
ContainerName: "ignition",
853+
BlobName: blobName,
854+
}.SignWithUserDelegation(udc)
855+
if err != nil {
856+
return nil, fmt.Errorf("failed to sign blob %s: %w", blobURL, err)
857+
}
858+
sasURL = fmt.Sprintf("https://%s.blob.%s/ignition/%s?%s", p.StorageAccountName, session.Environment.StorageEndpointSuffix, blobName, sasQueryParams.Encode())
859+
}
803860
ignShim, err := bootstrap.GenerateIgnitionShimWithCertBundleAndProxy(sasURL, in.InstallConfig.Config.AdditionalTrustBundle, in.InstallConfig.Config.Proxy)
804861
if err != nil {
805862
return nil, fmt.Errorf("failed to create ignition shim: %w", err)

0 commit comments

Comments
 (0)