Skip to content

Add support for managed identities in Azure #9

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
moizpgedge wants to merge 5 commits into from
Closed

Add support for managed identities in Azure #9

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
101c1e4
Add support for managed identities in Azure
mmols Jun 18, 2024
c521b1d
Minimize Azure Docker README to focus on Azure Blob Storage only
moizpgedge Dec 2, 2025
6e4c7fb
Add Azure Managed Identity setup and blob storage details to Docker R…
moizpgedge Dec 2, 2025
681c7e9
Remove sensitive ARGs from Dockerfile to fix security warnings
moizpgedge Dec 2, 2025
ed2630b
Merge branch 'integration' into azure-managed-identities
mmols Dec 3, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 2 additions & 0 deletions doc/src/build/config/config.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -120,6 +120,8 @@ option:
log-level-stderr: {type: string, required: false, command: {noop: {}}}
pg: {type: string, required: false, command: {noop: {}}}
pg-path: {type: string, required: false, command: {noop: {}}}
repo-azure-key: {type: string, required: false, command: {noop: {}}}
repo-azure-key-type: {type: string-id, default: shared, allow-list: [auto, shared, sas], command: {noop: {}}}
repo-type: {type: string, required: false, command: {noop: {}}}
repo: {type: string, required: false, command: {noop: {}}}
spool-path: {type: string, required: false, command: {noop: {}}}
Expand Down
2 changes: 2 additions & 0 deletions doc/src/build/help/help.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -20,6 +20,8 @@
<option id="log-level-file"><summary></summary><text><p></p></text></option>
<option id="log-level-stderr"><summary></summary><text><p></p></text></option>
<option id="repo"><summary></summary><text><p></p></text></option>
<option id="repo-azure-key"><summary></summary><text><p></p></text></option>
<option id="repo-azure-key-type"><summary></summary><text><p></p></text></option>
<option id="repo-type"><summary></summary><text><p></p></text></option>
<option id="spool-path"><summary></summary><text><p></p></text></option>
<option id="stanza"><summary></summary><text><p></p></text></option>
Expand Down
13 changes: 12 additions & 1 deletion src/build/config/config.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2183,13 +2183,24 @@ option:
default: blob.core.windows.net

repo-azure-key:
inherit: repo-azure-account
section: global
group: repo
type: string
secure: true
command: repo-type
required: false
depend:
option: repo-azure-key-type
list:
- shared
- sas

repo-azure-key-type:
inherit: repo-azure-container
type: string-id
default: shared
allow-list:
- auto
- shared
- sas

Expand Down
1 change: 1 addition & 0 deletions src/build/help/help.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -542,6 +542,7 @@
<p>The following types are supported for authorization:</p>

<list>
<list-item><id>auto</id> - Automatically authorize using Azure Managed identities</list-item>
<list-item><id>shared</id> - Shared key</list-item>
<list-item><id>sas</id> - Shared access signature</list-item>
</list>
Expand Down
4 changes: 2 additions & 2 deletions src/common/debug.h
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -359,12 +359,12 @@ Ignore DEBUG_TEST_TRACE_MACRO if DEBUG is not defined because the underlying fun

#define FUNCTION_TEST_BEGIN() \
FUNCTION_TEST_MEM_CONTEXT_AUDIT_BEGIN(); \
\
\
/* Ensure that FUNCTION_LOG_BEGIN() and FUNCTION_TEST_BEGIN() are not both used in a single function by declaring the */ \
/* same variable that FUNCTION_LOG_BEGIN() uses to track logging */ \
LogLevel FUNCTION_LOG_LEVEL(); \
(void)FUNCTION_LOG_LEVEL(); \
\
\
/* Ensure that FUNCTION_TEST_RETURN*() is not used with FUNCTION_LOG_BEGIN*() by declaring a variable that will be */ \
/* referenced in FUNCTION_TEST_RETURN*() */ \
bool FUNCTION_TEST_BEGIN_exists; \
Expand Down
2 changes: 2 additions & 0 deletions src/config/config.auto.h
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -238,6 +238,8 @@ Option value constants
#define CFGOPTVAL_REMOTE_TYPE_REPO STRID5("repo", 0x7c0b20)
#define CFGOPTVAL_REMOTE_TYPE_REPO_Z "repo"

#define CFGOPTVAL_REPO_AZURE_KEY_TYPE_AUTO STRID5("auto", 0x7d2a10)
#define CFGOPTVAL_REPO_AZURE_KEY_TYPE_AUTO_Z "auto"
#define CFGOPTVAL_REPO_AZURE_KEY_TYPE_SAS STRID5("sas", 0x4c330)
#define CFGOPTVAL_REPO_AZURE_KEY_TYPE_SAS_Z "sas"
#define CFGOPTVAL_REPO_AZURE_KEY_TYPE_SHARED STRID5("shared", 0x85905130)
Expand Down
10 changes: 6 additions & 4 deletions src/config/parse.auto.c.inc
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5367,7 +5367,7 @@ static const ParseRuleOption parseRuleOption[CFG_OPTION_TOTAL] =
PARSE_RULE_OPTION_NAME("repo-azure-key"), // opt/repo-azure-key
PARSE_RULE_OPTION_TYPE(String), // opt/repo-azure-key
PARSE_RULE_OPTION_RESET(true), // opt/repo-azure-key
PARSE_RULE_OPTION_REQUIRED(true), // opt/repo-azure-key
PARSE_RULE_OPTION_REQUIRED(false), // opt/repo-azure-key
PARSE_RULE_OPTION_SECTION(Global), // opt/repo-azure-key
PARSE_RULE_OPTION_SECURE(true), // opt/repo-azure-key
PARSE_RULE_OPTION_GROUP_ID(Repo), // opt/repo-azure-key
Expand Down Expand Up @@ -5435,8 +5435,9 @@ static const ParseRuleOption parseRuleOption[CFG_OPTION_TOTAL] =
( // opt/repo-azure-key
PARSE_RULE_OPTIONAL_DEPEND // opt/repo-azure-key
( // opt/repo-azure-key
PARSE_RULE_VAL_OPT(RepoType), // opt/repo-azure-key
PARSE_RULE_VAL_STRID(Azure), // opt/repo-azure-key
PARSE_RULE_VAL_OPT(RepoAzureKeyType), // opt/repo-azure-key
PARSE_RULE_VAL_STRID(Shared), // opt/repo-azure-key
PARSE_RULE_VAL_STRID(Sas), // opt/repo-azure-key
), // opt/repo-azure-key
), // opt/repo-azure-key
), // opt/repo-azure-key
Expand Down Expand Up @@ -5520,6 +5521,7 @@ static const ParseRuleOption parseRuleOption[CFG_OPTION_TOTAL] =
// opt/repo-azure-key-type
PARSE_RULE_OPTIONAL_ALLOW_LIST // opt/repo-azure-key-type
( // opt/repo-azure-key-type
PARSE_RULE_VAL_STRID(Auto), // opt/repo-azure-key-type
PARSE_RULE_VAL_STRID(Shared), // opt/repo-azure-key-type
PARSE_RULE_VAL_STRID(Sas), // opt/repo-azure-key-type
), // opt/repo-azure-key-type
Expand Down Expand Up @@ -11721,7 +11723,6 @@ static const uint8_t optionResolveOrder[] =
cfgOptRepoAzureAccount, // opt-resolve-order
cfgOptRepoAzureContainer, // opt-resolve-order
cfgOptRepoAzureEndpoint, // opt-resolve-order
cfgOptRepoAzureKey, // opt-resolve-order
cfgOptRepoAzureKeyType, // opt-resolve-order
cfgOptRepoAzureUriStyle, // opt-resolve-order
cfgOptRepoBlock, // opt-resolve-order
Expand Down Expand Up @@ -11775,6 +11776,7 @@ static const uint8_t optionResolveOrder[] =
cfgOptPgHostCmd, // opt-resolve-order
cfgOptPgHostKeyFile, // opt-resolve-order
cfgOptPgHostPort, // opt-resolve-order
cfgOptRepoAzureKey, // opt-resolve-order
cfgOptRepoGcsBucket, // opt-resolve-order
cfgOptRepoGcsEndpoint, // opt-resolve-order
cfgOptRepoGcsKey, // opt-resolve-order
Expand Down
60 changes: 57 additions & 3 deletions src/config/parse.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2743,10 +2743,16 @@ cfgParse(const Storage *const storage, const unsigned int argListSize, const cha
// Else error if option is required and help was not requested
else if (!config->help)
{
const bool required =
bool required =
cfgParseOptionalRule(&optionalRules, parseRuleOptionalTypeRequired, config->command, optionId) ?
optionalRules.required : ruleOption->required;

// If a dependency exists and is not valid, the option should not be required
// This handles cases where an option is only required when a dependency value is in a specific list
// Check dependId to ensure a dependency check was actually performed
if (required && dependResult.dependId != 0 && !dependResult.valid)
required = false;

if (required)
{
THROW_FMT(
Expand All @@ -2761,9 +2767,57 @@ cfgParse(const Storage *const storage, const unsigned int argListSize, const cha
if (optionGroup && configOptionValue->source != cfgSourceDefault)
optionGroupIndexKeep[optionGroupId][optionListIdx] = true;
}
// Else apply the default for the unresolved dependency, if it exists
else if (dependResult.defaultExists)
// Else dependency is not valid - check if option is required
else
{
// If option is not set, check if it's required
if ((!configOptionValue->set && !parseOptionValue->negate) || config->help)
{
// If the option has a default, only apply it if the dependency is valid
// If dependency is invalid, don't apply defaults as they may cause dependent options to be incorrectly
// required
if (cfgParseOptionalRule(&optionalRules, parseRuleOptionalTypeDefault, config->command, optionId) &&
(dependResult.dependId == 0 || dependResult.valid))
{
if (!configOptionValue->set)
{
configOptionValue->set = true;
configOptionValue->value = optionalRules.defaultValue;
configOptionValue->display = optionalRules.defaultRaw;
}

configOptionValue->defaultValue = optionalRules.defaultRaw;
}
// Else error if option is required and help was not requested
else if (!config->help)
{
bool required =
cfgParseOptionalRule(&optionalRules, parseRuleOptionalTypeRequired, config->command, optionId) ?
optionalRules.required : ruleOption->required;

// If a dependency exists and is not valid, the option should not be required
// This handles cases where an option is only required when a dependency value is in a specific list
if (required && dependResult.dependId != 0 && !dependResult.valid)
required = false;

if (required)
{
THROW_FMT(
OptionRequiredError, "%s command requires option: %s%s",
cfgParseCommandName(config->command), cfgParseOptionKeyIdxName(optionId, optionKeyIdx),
ruleOption->section == cfgSectionStanza ? "\nHINT: does this stanza exist?" : "");
}
}
}

// Apply the default for the unresolved dependency, if it exists
if (dependResult.defaultExists)
{
configOptionValue->set = true;
configOptionValue->value = dependResult.defaultValue;
configOptionValue->defaultValue = optionalRules.defaultRaw;
configOptionValue->display = optionalRules.defaultRaw;
}
// Fully reinitialize since it might have been left partially set if dependency was not resolved
*configOptionValue = (ConfigOptionValue)
{
Expand Down
2 changes: 1 addition & 1 deletion src/storage/azure/helper.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -52,7 +52,7 @@ storageAzureHelper(const unsigned int repoIdx, const bool write, StoragePathExpr

// Ensure the key is valid base64 when key type is shared
const StorageAzureKeyType keyType = (StorageAzureKeyType)cfgOptionIdxStrId(cfgOptRepoAzureKeyType, repoIdx);
const String *const key = cfgOptionIdxStr(cfgOptRepoAzureKey, repoIdx);
const String *const key = cfgOptionIdxStrNull(cfgOptRepoAzureKey, repoIdx);

if (keyType == storageAzureKeyTypeShared)
{
Expand Down
Loading
Loading