search

elastic / elasticsearch

Free and Open, Distributed, RESTful Search Engine
https://www.elastic.co/products/elasticsearch
Other
68.54k stars 24.35k forks source link

Support repository-azure snapshot plugin with "managed identity" #89633

Open Leaf-Lin opened 1 year ago

Leaf-Lin commented 1 year ago

Description

Microsoft is recommending Managed Identities as a superior way of authorizing access.

A common challenge for developers is the management of secrets, credentials, certificates, and keys used to secure communication between services. Managed identities eliminate the need for developers to manage these credentials.

Azure Blob Storage supports Azure Active Directory (Azure AD) authentication with managed identities for Azure resources. Managed identities for Azure resources can authorize access to blob data using Azure AD credentials from applications running in Azure virtual machines (VMs), function apps, virtual machine scale sets, and other services. By using managed identities for Azure resources together with Azure AD authentication, you can avoid storing credentials with your applications that run in the cloud.

I think this issue is different from https://github.com/elastic/elasticsearch/issues/69075 where it requests https://docs.microsoft.com/en-us/azure/aks/use-azure-ad-pod-identity for Kubernetes Service only. But if we can resolve these two issues with a similar approach, that would be great.

elasticsearchmachine commented 1 year ago

Pinging @elastic/es-distributed (Team:Distributed)

artificial-aidan commented 10 months ago

I put together a POC on a fork here.

First time working in Java, and this repo is pretty complicated, but it's working for me. Maybe somebody could take over who is more familiar, or help me work through some of the non-code changes needed.

I think it could be done more cleanly but adding new settings and whatnot, but as a first time contribution, that wasn't as well documented at first glance.

artificial-aidan commented 7 months ago

Bump? Any thoughts, should I open a PR?

horvatal commented 7 months ago

I would try a PR, than it gets more visible to the maintainers ;-)

sabarishkre commented 4 days ago

@artificial-aidan Any PR out yet?

artificial-aidan commented 4 days ago

No, but I've been running the code in production since I made this issue, no problems.

sabarishkre commented 4 days ago

You mean you've been running a build from your repo/branch, containing your changes to support workload identity, in production? If yes, can you provide some more details - does it work with AKS having pod identities as well? Thanks!

artificial-aidan commented 4 days ago

You mean you've been running a build from your repo/branch, containing your changes to support workload identity, in production? If yes, can you provide some more details - does it work with AKS having pod identities as well? Thanks!

I do not use pod identities, but it might work. It just uses the default methods of loading credentials. For workload identities it works fine.