Skip to content

Commit 86e577b

Browse files
committed
fix(azdls): load Azure credentials from environment variables
The azdls backend was not calling `AzureStorageConfig::default().from_env()` unlike the azblob backend, which meant Azure Workload Identity environment variables (AZURE_FEDERATED_TOKEN_FILE, AZURE_CLIENT_ID, AZURE_TENANT_ID, AZURE_AUTHORITY_HOST) were never loaded. This caused reqsign to skip the workload identity credential provider and fall through to IMDS, which fails in non-Azure-VM environments like AKS with Workload Identity. This patch matches the pattern used in the azblob backend: start with `from_env()` and then overlay any explicitly configured values.
1 parent 643b9e3 commit 86e577b

File tree

1 file changed

+31
-14
lines changed

1 file changed

+31
-14
lines changed

core/services/azdls/src/backend.rs

Lines changed: 31 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -252,20 +252,37 @@ impl Builder for AzdlsBuilder {
252252
}?;
253253
debug!("backend use endpoint {}", &endpoint);
254254

255-
let config_loader = AzureStorageConfig {
256-
account_name: self
257-
.config
258-
.account_name
259-
.clone()
260-
.or_else(|| azure_account_name_from_endpoint(endpoint.as_str())),
261-
account_key: self.config.account_key.clone(),
262-
sas_token: self.config.sas_token,
263-
client_id: self.config.client_id.clone(),
264-
client_secret: self.config.client_secret.clone(),
265-
tenant_id: self.config.tenant_id.clone(),
266-
authority_host: self.config.authority_host.clone(),
267-
..Default::default()
268-
};
255+
#[cfg(target_arch = "wasm32")]
256+
let mut config_loader = AzureStorageConfig::default();
257+
#[cfg(not(target_arch = "wasm32"))]
258+
let mut config_loader = AzureStorageConfig::default().from_env();
259+
260+
if let Some(v) = self
261+
.config
262+
.account_name
263+
.clone()
264+
.or_else(|| azure_account_name_from_endpoint(endpoint.as_str()))
265+
{
266+
config_loader.account_name = Some(v);
267+
}
268+
if let Some(v) = self.config.account_key.clone() {
269+
config_loader.account_key = Some(v);
270+
}
271+
if let Some(v) = self.config.sas_token {
272+
config_loader.sas_token = Some(v);
273+
}
274+
if let Some(v) = self.config.client_id.clone() {
275+
config_loader.client_id = Some(v);
276+
}
277+
if let Some(v) = self.config.client_secret.clone() {
278+
config_loader.client_secret = Some(v);
279+
}
280+
if let Some(v) = self.config.tenant_id.clone() {
281+
config_loader.tenant_id = Some(v);
282+
}
283+
if let Some(v) = self.config.authority_host.clone() {
284+
config_loader.authority_host = Some(v);
285+
}
269286

270287
let cred_loader = AzureStorageLoader::new(config_loader);
271288
let signer = AzureStorageSigner::new();

0 commit comments

Comments
 (0)