influxdata / influxdata/telegraf
Managed Identity support for Azure queue storage input plugin
Nobody has claimed this yet.
- Dominant language
- Go
- Stars
- 17.8k
- Forks
- 5.8k
- Avg merge
- 1d 20h
- Merged PRs (30d)
- 161
Description
### Use Case
Current mode of access to an Azure storage account with the storage queue plugin is with a shared access key. Handling the key as a secret in an environment like k8s can become more difficult than it needs to be. Also in the case of an exploiter getting hold of access keys, it not only allows them to access queue services, but also blob storage and tables. From the perspective of security and also ease in deployment, it would be a neat addition to have support for Managed Identities there.
### Expected behavior
Adding optional configuration keys for managed identity and making `account_key` optional
```toml
# Gather Azure Storage Queue metrics
[[inputs.azure_storage_queue]]
## Azure Storage Account name and shared access key (optional)
account_name = "mystorageaccount"
account_key = "storageaccountaccesskey" # made optional
## Azure Managed identity (optional)
use_managed_identity = true # could be omitted
client_id = "<>"
## Disable peeking age of oldest message (faster)
# peek_oldest_message_age = true
```
### Actual behavior
Configuration only allows for shared access key and it is required:
```toml
# Gather Azure Storage Queue metrics
[[inputs.azure_storage_queue]]
## Azure Storage Account name and shared access key (required)
account_name = "mystorageaccount"
account_key = "storageaccountaccesskey"
## Disable peeking age of oldest message (faster)
# peek_oldest_message_age = true
```
### Additional info
_No response_
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by locating the Azure storage queue input plugin and reading its current configuration and shared-key authentication path. Add support for optional managed identity settings, including client_id, while allowing account_key to be omitted; done means the plugin can authenticate with either shared keys or managed identity as shown in the issue.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- azure, go
- Domain
- cloud
- Issue type
- Feature
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 45/100