Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add storage account name as a property to StorageAccountOperatorSecrets #3446

Closed
jonasnorlund opened this issue Oct 19, 2023 · 4 comments
Closed

Comments

@jonasnorlund
Copy link

Description
Today when a storage account is created the operatorspec can create secrets and configmaps. Under the secrets creation there are a few properties but we are missing the storage account name as a property.

If we want to automate the process of enabling storage for consumers of a namespace this is needed.

Use ASO to create storage in one process using a GitOps flow (ArgoCD or Flux)

  1. Create storage account (when the storage account is created a secret is also created with the key.)
  2. Create StorageAccountsFileService
  3. Create StorageAccountsFileServicesShare
  4. Create a Persistent Volume which refers to the secret that has been created in step 1. The PV refers to the secret using "nodeStageSecretRef.name" (https://github.com/kubernetes-sigs/azurefile-csi-driver/blob/master/docs/driver-parameters.md#static-provisionbring-your-own-file-share)

Next step would be to create a PVC but that fails due to the secret is missing the storage account name.

This property is needed when working with static provisioning of PV's.

Improvement
Add the storage account name as a property to https://azure.github.io/azure-service-operator/reference/storage/v1api20220901/#storage.azure.com/v1api20220901.StorageAccountOperatorSecrets

@matthchr
Copy link
Member

This seems very related to #2555, but it might make sense to do this now even though we have a longer term item to do better there.

@matthchr matthchr added this to the v2.5.0 milestone Oct 23, 2023
@theunrepentantgeek
Copy link
Member

Is the name of that storage account actually a secret? That is, is it sensitive? I'm wondering whether this should be published to a configmap instead.

@jonasnorlund
Copy link
Author

Hi, when using secrets to authenticate against a PV (multitenant scenario when you don't want the kubelet identity to be used) you need the storage account name in the secret.

See more info here https://github.com/kubernetes-sigs/azurefile-csi-driver/blob/master/docs/driver-parameters.md#tips

@theunrepentantgeek theunrepentantgeek modified the milestones: v2.6.0, v2.7.0 Dec 11, 2023
@matthchr matthchr removed this from the v2.7.0 milestone Feb 22, 2024
@matthchr
Copy link
Member

Closing this in favor of #2555. We're committed to taking a generic approach here that allows export of any status field (as well as any secret). That way users can do whatever they want/need.

@github-project-automation github-project-automation bot moved this from Backlog to Recently Completed in Azure Service Operator Roadmap Jul 15, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
Development

No branches or pull requests

3 participants