influxdata / influxdata/telegraf

Managed Identity support for Azure queue storage input plugin

Open
#18,111 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

feature request
Dominant language
Go
Stars
17.8k
Forks
5.8k
Avg merge
1d 20h
Merged PRs (30d)
161

Description

### Use Case

Current mode of access to an Azure storage account with the storage queue plugin is with a shared access key. Handling the key as a secret in an environment like k8s can become more difficult than it needs to be. Also in the case of an exploiter getting hold of access keys, it not only allows them to access queue services, but also blob storage and tables. From the perspective of security and also ease in deployment, it would be a neat addition to have support for Managed Identities there.

### Expected behavior

Adding optional configuration keys for managed identity and making `account_key` optional

```toml
# Gather Azure Storage Queue metrics
[[inputs.azure_storage_queue]]
## Azure Storage Account name and shared access key (optional)
account_name = "mystorageaccount"
account_key = "storageaccountaccesskey" # made optional

## Azure Managed identity (optional)
use_managed_identity = true # could be omitted
client_id = "<>"

## Disable peeking age of oldest message (faster)
# peek_oldest_message_age = true
```

### Actual behavior

Configuration only allows for shared access key and it is required:

```toml
# Gather Azure Storage Queue metrics
[[inputs.azure_storage_queue]]
## Azure Storage Account name and shared access key (required)
account_name = "mystorageaccount"
account_key = "storageaccountaccesskey"

## Disable peeking age of oldest message (faster)
# peek_oldest_message_age = true
```

### Additional info

_No response_

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start by locating the Azure storage queue input plugin and reading its current configuration and shared-key authentication path. Add support for optional managed identity settings, including client_id, while allowing account_key to be omitted; done means the plugin can authenticate with either shared keys or managed identity as shown in the issue.

Written by the indexing model from the issue text.

Assessment

Tech stack
azure, go
Domain
cloud
Issue type
Feature
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
45/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.