Fix azureblob keyless auth: always emit jclouds.credential (fixes #27) - #29
Merged
Merged
Conversation
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
Closed
CRThaze
force-pushed
the
CRThaze/fix-azureblob-keyless-jclouds-credential
branch
from
July 27, 2026 12:33
d96a9c3 to
36c4540
Compare
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
S3Proxy requires both jclouds.identity and jclouds.credential in every
backend properties file; only filesystem-nio2, transient-nio2 and
google-cloud-storage-sdk are exempt from that check in Main.java. The
azureblob backend defaults to the azureblob-sdk provider, which is NOT
exempt, so when it authenticates via Azure Workload Identity (account
set, no storage account key) the rendered properties file omitted
jclouds.credential entirely and S3Proxy exited on startup with:
Properties file must contain: jclouds.identity and jclouds.credential
Emit an empty `jclouds.credential=` whenever no storage account key is
provided. This keys off key.value alone (not key.value OR sasToken.value),
which also covers the SAS-token-only path: SAS auth carries the token via
jclouds.azureblob.sas but never sets jclouds.credential, so it hit the
same startup failure.
Verified with `helm template` for workload-identity, SAS-only, and
key-based configs. Chart version bumped 0.4.0 -> 0.4.1.
Fixes #27
CRThaze
force-pushed
the
CRThaze/fix-azureblob-keyless-jclouds-credential
branch
from
July 27, 2026 12:35
36c4540 to
ad0d3b0
Compare
📝 README.md PreviewThe following changes to Click to expand diffdiff --git a/README.md b/README.md
index acd9c4f..5d3b508 100644
--- a/README.md
+++ b/README.md
@@ -1,6 +1,6 @@
# s3proxy
-  
+  
A Helm chart for deploying S3Proxy - Access other storage backends via the S3 API
|
📊 Helm Render Diff SummaryChart
🔍 Detailed Changes📝 Changes in
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes #27.
Problem
S3Proxy's
Main.javahard-requires bothjclouds.identityandjclouds.credentialto be present in every backend properties file:Only
filesystem-nio2,transient-nio2, andgoogle-cloud-storage-sdkget a null→empty pass. Every other provider must have both properties physically present (empty string is fine; absent is fatal).The
azureblobbackend defaults to theazureblob-sdkprovider, which is not on that exempt list. When it authenticates via Azure Workload Identity (account set, no storage account key), the chart renderedjclouds.identity=<account>but omittedjclouds.credentialentirely, so the container crashed on startup:Fix
Emit an empty
jclouds.credential=whenever no storage account key is supplied.jclouds.credentialin the merged file comes only fromsecret-azureblob.properties, which is rendered only underif key.value, so keying the else-branch offkey.valuealone is what guarantees the property is always present.Verification (
helm template)jclouds.credentialin ConfigMapjclouds.credential=(empty)jclouds.credential=(empty) +jclouds.azureblob.sas=…merged from Secrethelm lintclean; full manifest is valid YAML. Chart version bumped0.4.0 → 0.4.1.