Support Identity + RBAC access for Azure storage
- Dominant language
- Go
- Stars
- 30.1k
- Forks
- 4.6k
- Avg merge
- 1d 18h
- Merged PRs (30d)
- 39
Description
#### Feature Description
In Consul 1.7, the `go-autorest` library is updated and supports Azure managed identities. With this identity, an access token and RBAC access may be leveraged to use Azure storage. I'm requesting that Consul support this access method instead of relying on the `account_key` parameter when using `azure_blob_storage` in the config file. The `account_key` is a secret value and having it plaintext in a file is not ideal.
#### Use Case(s)
* Consul running on VM with managed identity assigned. This identity is granted read+write access to the storage account. User configured the `account_name` and `container_name` parameters in consul. Consul leverages this information and its identity's access token to access storage.
Related to #6999
Contributor guide
Research direction
Start by locating the azure_blob_storage configuration handling and the current account_key usage, then review the go-autorest update and its managed-identity support. The change should allow account_name and container_name to work with an Azure managed identity and RBAC access without requiring a plaintext account_key; related issue #6999 may provide context.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- azure, go
- Domain
- authentication, cloud
- Issue type
- Feature
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100