mirrors/velero
1
0
Fork 0
mirror of https://github.com/vmware-tanzu/velero.git synced 2026-08-28 11:56:42 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

stop routing credential selection on AZURE_USERNAME after username/password removal (#10363)

Browse Source 
* stop routing credential selection on AZURE_USERNAME after username/password removal

Signed-off-by: samay43 <samayrbhat43@gmail.com>

* add changelog entry

Signed-off-by: samay43 <samayrbhat43@gmail.com>

---------

Signed-off-by: samay43 <samayrbhat43@gmail.com>
This commit is contained in:
R4mbo
2026-08-26 17:57:36 +08:00
committed by GitHub
parent e33d8a3f84
commit a3d585f78d
3 changed files with 24 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
changelogs/unreleased/10363-samay43
+1
View File
@@ -0,0 +1 @@
stop routing credential selection on AZURE_USERNAME after username/password removal
pkg/util/azure/credential.go
+1 -2
View File
@@ -37,8 +37,7 @@ func NewCredential(creds map[string]string, options policy.ClientOptions) (azcor
// config credential
if len(creds[CredentialKeyClientSecret]) > 0 ||
len(creds[CredentialKeyClientCertificate]) > 0 ||
len(creds[CredentialKeyClientCertificatePath]) > 0 ||
len(creds[CredentialKeyUsername]) > 0 {
len(creds[CredentialKeyClientCertificatePath]) > 0 {
return newConfigCredential(creds, configCredentialOptions{
ClientOptions: options,
AdditionallyAllowedTenants: additionalTenants,
pkg/util/azure/credential_test.go
+22
View File
@@ -69,6 +69,28 @@ func TestNewCredential(t *testing.T) {
assert.IsType(t, &azidentity.WorkloadIdentityCredential{}, tokenCredential)
os.Clearenv()
// a leftover AZURE_USERNAME must not hijack credential selection. Username/password
// handling was removed from newConfigCredential in #9041, so routing on it sends the
// caller into a function that cannot serve it and short-circuits the workload
// identity and managed identity branches below.
os.Setenv(CredentialKeyTenantID, "tenantid")
os.Setenv(CredentialKeyClientID, "clientid")
os.Setenv("AZURE_FEDERATED_TOKEN_FILE", "/tmp/token")
creds = map[string]string{CredentialKeyUsername: "username"}
tokenCredential, err = NewCredential(creds, options)
require.NoError(t, err)
assert.IsType(t, &azidentity.WorkloadIdentityCredential{}, tokenCredential)
os.Clearenv()
// ... and must not short-circuit managed identity either
creds = map[string]string{
CredentialKeyClientID: "clientid",
CredentialKeyUsername: "username",
}
tokenCredential, err = NewCredential(creds, options)
require.NoError(t, err)
assert.IsType(t, &azidentity.ManagedIdentityCredential{}, tokenCredential)
// managed identity credential
creds = map[string]string{CredentialKeyClientID: "clientid"}
tokenCredential, err = NewCredential(creds, options)