Skip to content

Add support for Azure Managed Identities in cache

Stan Hu requested to merge sh-azure-managed-identities-cache into main

What does this MR do?

This adds support for Azure Managed Identities in cache. This merge request allows AccountKey to be omitted from the config file. When the account key is omitted, when the runner wants to upload a Azure blob it retrieves the credentials from the metadata instance endpoint. As a result, we need to pass the request context along.

Why was this MR needed?

This feature allows admins to omit the account key and use temporary credentials to access the cache. This is similar to AWS's IAM profile.

What's the best way to test this MR?

  1. Set up an Azure Storage Blob container (portal.azure.com).
  2. Create a VM. Under the Management tab click on Enable system assigned managed identity:

image

  1. In the Azure portal, click on Resource groups.
  2. Select your resource group and then Access control (IAM).
  3. Click Add -> Add role assignment.
  4. Search Blob in the field, select Storage Data Blob Owner, and click on Next:

image

  1. Click on the Members tab -> Assign access to -> Managed identity.
  2. On the right tab, use the dropdown to select Managed identity -> Virtual machine:

image

  1. Search for the VM that you created, click on it, click Select, and Review and assign.
  2. Once that has selected, edit your config.toml to include the ContainerName and AccountName. Remove AccountKey if it is present:
  [runners.cache]
    MaxUploadedArchiveSize = 0
    Type = "azure"
    [runners.cache.s3]
    [runners.cache.gcs]
    [runners.cache.azure]
    ContainerName = "test1"
    AccountName = "YOUR-AZURE-ACCOUNT-NAME"
  1. Now run a CI job that uses the cache:
default:
  script:
    - echo "hello world" > test.txt
  cache:
    paths:
      - test.txt

What are the relevant issue numbers?

Relates to #27303 (closed)

Edited by Stan Hu

Merge request reports

Loading