Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

feat(azure-storage): allow use of AzureDefaultCredential class for uploading and downloading to azure #250

Open
wants to merge 1 commit into
base: master
Choose a base branch
from

Conversation

duncan485
Copy link

Using the DefaultAzureCredential class, the following methods can be used to authenticate to the storage account (also see https://learn.microsoft.com/en-us/python/api/azure-identity/azure.identity.defaultazurecredential?view=azure-python):

1. A service principal configured by environment variables. See [EnvironmentCredential](https://learn.microsoft.com/en-us/python/api/azure-identity/azure.identity.environmentcredential?view=azure-python) for more details.
2. WorkloadIdentityCredential if environment variable configuration is set by the Azure workload identity webhook.
3. An Azure managed identity. See [ManagedIdentityCredential](https://learn.microsoft.com/en-us/python/api/azure-identity/azure.identity.managedidentitycredential?view=azure-python) for more details.
4. On Windows only: a user who has signed in with a Microsoft application, such as Visual Studio. If multiple identities are in the cache, then the value of the environment variable AZURE_USERNAME is used to select which identity to use. See [SharedTokenCacheCredential](https://learn.microsoft.com/en-us/python/api/azure-identity/azure.identity.sharedtokencachecredential?view=azure-python) for more details.
5. The identity currently logged in to the Azure CLI.
6. The identity currently logged in to Azure PowerShell.
7.The identity currently logged in to the Azure Developer CLI.

My use case would be to use WorkloadIdentityCredential to have my AKS cronjob authenticate to azure blob storage with it's identity, so I don't have to manage the connection_string/secret

@duncan485
Copy link
Author

@ysde I tried to keep the changes as minimal and none invasive as possible, would love to hear what you think

@nilfr
Copy link

nilfr commented Feb 2, 2024

@ysde Can we get this reviewed and merged, because this would allow workload identity to be used, which would greatly improve security as it can work without the use of passwords.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants