AzureStorageAuthType SPN with Inline volume

[PLCyr]

Hi ! I'm trying to use the AzureStorageAuthType SPN with an inline volume (without persistentVolume).
There seems to be an issue for the secret which will contain the clientSecret for the SPN.
I'm not sure if it suppose to work, please advice !

[andyzhangx]

try config like following:

kubectl create secret generic azure-secret --from-literal azurestoragespnclientsecret="xxx" --type=Opaque

  volumes:
    - name: persistent-storage
      csi:
        driver: blob.csi.azure.com
        volumeAttributes:
          resourceGroup: EXISTING_RESOURCE_GROUP_NAME
          storageAccount: EXISTING_STORAGE_ACCOUNT_NAME
          containerName: EXISTING_CONTAINER_NAME
          secretName: azure-secret
          AzureStorageAuthType: spn
          AzureStorageSPNClientID:
          AzureStorageSPNTenantID:
          AzureStorageAADEndpoint:
          mountOptions: "-o allow_other --file-cache-timeout-in-seconds=120"  # optional

[andyzhangx]

it looks like clientid is incorrect

[PLCyr]

I'm using the same ClientId, ClientSecret, TenantId with AzCopy with no problem. However the error seems to be that the client_secret isn't in the request

'client_assertion', 'client_secret' or 'request' is required for the 'client_credentials' grant type

Is there a way to see what request is done by csi-blob-node pod ?

[andyzhangx]

I double checked the code, AzureStorageAuthType SPN is not supported in Inline volume, pls try with pv/pvc, the secret should be specified in nodeStageSecretRef, example:

blob-csi-driver/deploy/example/pv-blobfuse-auth.yaml

Lines 37 to 39 in c678314

	nodeStageSecretRef: # secret should be stored here
	name: azure-secret
	namespace: default

[PLCyr]

Is it suppose to be supported in an incoming version ?

[andyzhangx]

we will evaluate this requirement, you could track this issue: #840