hashicorp / hashicorp/consul

Support Identity + RBAC access for Azure storage

Open
#7,234 0 comments 3 reactions 0 assignees View on GitHub
needs-discussion type/enhancement
Dominant language
Go
Stars
30.1k
Forks
4.6k
Avg merge
1d 18h
Merged PRs (30d)
39

Description

#### Feature Description

In Consul 1.7, the `go-autorest` library is updated and supports Azure managed identities. With this identity, an access token and RBAC access may be leveraged to use Azure storage. I'm requesting that Consul support this access method instead of relying on the `account_key` parameter when using `azure_blob_storage` in the config file. The `account_key` is a secret value and having it plaintext in a file is not ideal.

#### Use Case(s)

* Consul running on VM with managed identity assigned. This identity is granted read+write access to the storage account. User configured the `account_name` and `container_name` parameters in consul. Consul leverages this information and its identity's access token to access storage.

Related to #6999

Contributor guide

Open the contributing guide

Research direction

Start by locating the azure_blob_storage configuration handling and the current account_key usage, then review the go-autorest update and its managed-identity support. The change should allow account_name and container_name to work with an Azure managed identity and RBAC access without requiring a plaintext account_key; related issue #6999 may provide context.

Written by the indexing model from the issue text.

Assessment

Tech stack
azure, go
Domain
authentication, cloud
Issue type
Feature
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.