Azure: add support for loading env vars from a file, $AZURE_CREDENTIALS_FILE (#1364)

* azure: load env vars from AZURE_CREDENTIALS_FILE if it exists

Signed-off-by: Steve Kriss <krisss@vmware.com>

pkg/cloudprovider/azure/common.go

@@ -17,10 +17,12 @@ limitations under the License.
 package azure
 
 import (
+	"os"
 	"strings"
 
 	"github.com/Azure/go-autorest/autorest/adal"
 	"github.com/Azure/go-autorest/autorest/azure"
+	"github.com/joho/godotenv"
 	"github.com/pkg/errors"
 )
 
@@ -48,6 +50,19 @@ func GetResticEnvVars(config map[string]string) (map[string]string, error) {
 	}, nil
 }
 
+func loadEnv() error {
+	envFile := os.Getenv("AZURE_CREDENTIALS_FILE")
+	if envFile == "" {
+		return nil
+	}
+
+	if err := godotenv.Overload(envFile); err != nil {
+		return errors.Wrapf(err, "error loading environment from AZURE_CREDENTIALS_FILE (%s)", envFile)
+	}
+
+	return nil
+}
+
 func newServicePrincipalToken(tenantID, clientID, clientSecret, scope string) (*adal.ServicePrincipalToken, error) {
 	oauthConfig, err := adal.NewOAuthConfig(azure.PublicCloud.ActiveDirectoryEndpoint, tenantID)
 	if err != nil {

pkg/cloudprovider/azure/object_store.go

@@ -47,6 +47,11 @@ func NewObjectStore(logger logrus.FieldLogger) *ObjectStore {
 }
 
 func getStorageAccountKey(config map[string]string) (string, error) {
+	// load environment vars from $AZURE_CREDENTIALS_FILE, if it exists
+	if err := loadEnv(); err != nil {
+		return "", err
+	}
+
 	// 1. we need AZURE_TENANT_ID, AZURE_CLIENT_ID, AZURE_CLIENT_SECRET, AZURE_SUBSCRIPTION_ID
 	envVars, err := getRequiredValues(os.Getenv, tenantIDEnvVar, clientIDEnvVar, clientSecretEnvVar, subscriptionIDEnvVar)
 	if err != nil {

pkg/cloudprovider/azure/volume_snapshotter.go

@@ -76,6 +76,11 @@ func (b *VolumeSnapshotter) Init(config map[string]string) error {
 		return err
 	}
 
+	// load environment vars from $AZURE_CREDENTIALS_FILE, if it exists
+	if err := loadEnv(); err != nil {
+		return err
+	}
+
 	// 1. we need AZURE_TENANT_ID, AZURE_CLIENT_ID, AZURE_CLIENT_SECRET, AZURE_SUBSCRIPTION_ID, AZURE_RESOURCE_GROUP
 	envVars, err := getRequiredValues(os.Getenv, tenantIDEnvVar, clientIDEnvVar, clientSecretEnvVar, subscriptionIDEnvVar, resourceGroupEnvVar)
 	if err != nil {

pkg/install/deployment.go

@@ -134,6 +134,10 @@ func Deployment(namespace string, opts ...podTemplateOption) *appsv1beta1.Deploy
 									Name:  "AWS_SHARED_CREDENTIALS_FILE",
 									Value: "/credentials/cloud",
 								},
+								{
+									Name:  "AZURE_CREDENTIALS_FILE",
+									Value: "/credentials/cloud",
+								},
 							},
 						},
 					},

pkg/install/deployment_test.go

@@ -32,7 +32,7 @@ func TestDeployment(t *testing.T) {
 	assert.Equal(t, "--restore-only", deploy.Spec.Template.Spec.Containers[0].Args[1])
 
 	deploy = Deployment("velero", WithEnvFromSecretKey("my-var", "my-secret", "my-key"))
-	envSecret := deploy.Spec.Template.Spec.Containers[0].Env[3]
+	envSecret := deploy.Spec.Template.Spec.Containers[0].Env[4]
 	assert.Equal(t, "my-var", envSecret.Name)
 	assert.Equal(t, "my-secret", envSecret.ValueFrom.SecretKeyRef.LocalObjectReference.Name)
 	assert.Equal(t, "my-key", envSecret.ValueFrom.SecretKeyRef.Key)