Fix azureblob keyless auth: always emit jclouds.credential (#27)

S3Proxy requires both jclouds.identity and jclouds.credential in every
backend properties file; only filesystem-nio2, transient-nio2 and
google-cloud-storage-sdk are exempt from that check in Main.java. The
azureblob backend defaults to the azureblob-sdk provider, which is NOT
exempt, so when it authenticates via Azure Workload Identity (account
set, no storage account key) the rendered properties file omitted
jclouds.credential entirely and S3Proxy exited on startup with:

    Properties file must contain: jclouds.identity and jclouds.credential

Emit an empty `jclouds.credential=` whenever no storage account key is
provided. This keys off key.value alone (not key.value OR sasToken.value),
which also covers the SAS-token-only path: SAS auth carries the token via
jclouds.azureblob.sas but never sets jclouds.credential, so it hit the
same startup failure.

Verified with `helm template` for workload-identity, SAS-only, and
key-based configs. Chart version bumped 0.4.0 -> 0.4.1.

Fixes #27

Author: CRThaze

charts/s3proxy/Chart.yaml

@@ -15,7 +15,7 @@ type: application
 # This is the chart version. This version number should be incremented each time you make changes
 # to the chart and its templates, including the app version.
 # Versions are expected to follow Semantic Versioning (https://semver.org/)
-version: 0.4.0
+version: 0.4.1
 
 # This is the version number of the application being deployed. This version number should be
 # incremented each time you make changes to the application. Versions are not expected to

charts/s3proxy/templates/configmap.yaml

@@ -177,8 +177,14 @@ data:
   {{- if .Values.config.backends.azureblob.account }}
     jclouds.identity={{ .Values.config.backends.azureblob.account }}
   {{- end }}
-  {{- if or .Values.config.backends.azureblob.key.value .Values.config.backends.azureblob.sasToken.value }}
-    # Credentials will be merged from the secret properties file
+  {{- /* When a storage account key is set, jclouds.credential is merged in from the
+         Secret. Otherwise the azureblob-sdk provider authenticates with the SAS token
+         (jclouds.azureblob.sas, merged from the Secret) or the ambient Azure Workload
+         Identity credentials injected into the pod. S3Proxy still requires
+         jclouds.credential in every backend properties file (only filesystem-nio2,
+         transient-nio2 and google-cloud-storage-sdk are exempt), so emit it empty. */}}
+  {{- if not .Values.config.backends.azureblob.key.value }}
+    jclouds.credential=
   {{- end }}
   {{- range $index, $bucket := .Values.config.backends.azureblob.bucketLocators }}
     s3proxy.bucket-locator.{{ add $index 1 }}={{ $bucket }}