ysde / grafana-backup-tool

A Python-based application to backup Grafana settings by using the Grafana API
MIT License
808 stars 269 forks source link

feat(azure-storage): allow use of AzureDefaultCredential class for uploading and downloading to azure #250

Open duncan485 opened 7 months ago

duncan485 commented 7 months ago

Using the DefaultAzureCredential class, the following methods can be used to authenticate to the storage account (also see https://learn.microsoft.com/en-us/python/api/azure-identity/azure.identity.defaultazurecredential?view=azure-python):

1. A service principal configured by environment variables. See [EnvironmentCredential](https://learn.microsoft.com/en-us/python/api/azure-identity/azure.identity.environmentcredential?view=azure-python) for more details.
2. WorkloadIdentityCredential if environment variable configuration is set by the Azure workload identity webhook.
3. An Azure managed identity. See [ManagedIdentityCredential](https://learn.microsoft.com/en-us/python/api/azure-identity/azure.identity.managedidentitycredential?view=azure-python) for more details.
4. On Windows only: a user who has signed in with a Microsoft application, such as Visual Studio. If multiple identities are in the cache, then the value of the environment variable AZURE_USERNAME is used to select which identity to use. See [SharedTokenCacheCredential](https://learn.microsoft.com/en-us/python/api/azure-identity/azure.identity.sharedtokencachecredential?view=azure-python) for more details.
5. The identity currently logged in to the Azure CLI.
6. The identity currently logged in to Azure PowerShell.
7.The identity currently logged in to the Azure Developer CLI.

My use case would be to use WorkloadIdentityCredential to have my AKS cronjob authenticate to azure blob storage with it's identity, so I don't have to manage the connection_string/secret

duncan485 commented 7 months ago

@ysde I tried to keep the changes as minimal and none invasive as possible, would love to hear what you think

nilfr commented 5 months ago

@ysde Can we get this reviewed and merged, because this would allow workload identity to be used, which would greatly improve security as it can work without the use of passwords.