-
Bug
-
Resolution: Won't Do
-
Undefined
-
None
-
4.18.0
-
None
-
Quality / Stability / Reliability
-
False
-
-
None
-
None
-
None
-
None
-
None
-
None
-
None
-
None
-
None
-
None
-
None
-
None
-
None
-
None
Description of problem:
When SAS Key access is disabled the azurefiles csi driver does not work because the SMB endpoint doesn't support EntraID federated auth.
Version-Release number of selected component (if applicable):
4.14 and newer which support Work Load Identity
How reproducible:
100%
Steps to Reproduce:
1. Install with allowSharedKeyAccess disabled
Actual results:
RWX volumes not available without SAS Key Access
Expected results:
RWX volumes available without SAS Key access
Additional info:
Separating this out from OCPBUGS-37587 which tracks installer support for installing without SAS.
The ARO design doc has many details https://docs.google.com/document/d/10G3VtMRfSyedijH179rlf9BLqE4r95BOMrTi2CodIZY/edit#heading=h.hxmwrukgbrf7
Additionally, there's an AKS issue on the topic too https://github.com/Azure/AKS/issues/3432#issuecomment-2172222830
https://github.com/kubernetes-sigs/azurefile-csi-driver/pull/1972 adds `allowSharedKeyAccess` flag, unclear what it's used for exactly.
This is mostly a bug to track collection of strategy to deal with this, not expecting an immediate code fix given it's clear the SMB endpoint doesn't support access without SAS.