Uploaded image for project: 'OpenShift Bugs'
  1. OpenShift Bugs
  2. OCPBUGS-39156

No RWX storage support with SAS keys disabled

XMLWordPrintable

    • Icon: Bug Bug
    • Resolution: Won't Do
    • Icon: Undefined Undefined
    • None
    • 4.18.0
    • Storage / Kubernetes
    • None
    • Quality / Stability / Reliability
    • False
    • Hide

      None

      Show
      None
    • None
    • None
    • None
    • None
    • None
    • None
    • None
    • None
    • None
    • None
    • None
    • None
    • None
    • None

      Description of problem:

      When SAS Key access is disabled the azurefiles csi driver does not work because the SMB endpoint doesn't support EntraID federated auth.

      Version-Release number of selected component (if applicable):

          4.14 and newer which support Work Load Identity

      How reproducible:

          100% 

      Steps to Reproduce:

          1. Install with allowSharedKeyAccess disabled    

      Actual results:

      RWX volumes not available without SAS Key Access

      Expected results:

      RWX volumes available without SAS Key access

      Additional info:

      Separating this out from OCPBUGS-37587 which tracks installer support for installing without SAS.

      The ARO design doc has many details https://docs.google.com/document/d/10G3VtMRfSyedijH179rlf9BLqE4r95BOMrTi2CodIZY/edit#heading=h.hxmwrukgbrf7

      Additionally, there's an AKS issue on the topic too https://github.com/Azure/AKS/issues/3432#issuecomment-2172222830

      https://github.com/kubernetes-sigs/azurefile-csi-driver/pull/1972 adds `allowSharedKeyAccess` flag, unclear what it's used for exactly.

      This is mostly a bug to track collection of strategy to deal with this, not expecting an immediate code fix given it's clear the SMB endpoint doesn't support access without SAS.

              rbednar@redhat.com Roman Bednar
              rhn-support-sdodson Scott Dodson
              Scott Dodson
              None
              Wei Duan Wei Duan
              None
              Votes:
              0 Vote for this issue
              Watchers:
              7 Start watching this issue

                Created:
                Updated:
                Resolved: