Cannot mount with AzureStorageIdentityClientID, but does work with clientID

[cedricve]

Thanks for your great work here @andyzhangx. We have been using Workload Identity in our AKS cluster. The mounting using the clientID does work properly.

csi:
  driver: blob.csi.azure.com
  volumeHandle: pv-xxx
  volumeAttributes:
    resourceGroup: rsg-xxx
    storageAccount: xxxx
    containerName: nokey
    protocol: fuse
    clientID: "xxx-xxx-xxx-xxx-xxx"

However when using the AzureStorageIdentity and more in particular following CSI parameters:

• AzureStorageIdentityClientID
• AzureStorageIdentityObjectID
• AzureStorageIdentityResourceID

Using following config:

csi:
  driver: blob.csi.azure.com
  volumeHandle: pv-xxx-xxx
  volumeAttributes:
    resourceGroup: rsg-xxx-xxx-d-xxx
    storageAccount: xxx
    containerName: nokey
    protocol: fuse
    AzureStorageIdentityResourceID : "/subscriptions/xxx-xxx-xxx-xxx-xxxx/resourceGroups/rsg-xxx-xxx-d-xxxx/providers/Microsoft.ManagedIdentity/userAssignedIdentities/mid-xxx-xxx-d-xxx-xxx"

We get following error:

88s         Warning   FailedMount         pod/xxx-xxx-xxx    MountVolume.MountDevice failed for volume "pv-xxx" : rpc error: code = Internal desc = no key for storage account(xxx) under resource group(rsg-xxx-xxx-d-xxx), err Retriable: false, RetryAfter: 0s, HTTPStatusCode: 403, RawError: {"error":{"code":"AuthorizationFailed","message":"The client 'xxx-xxx-xxx-xxx-xxx' with object id 'xxx-xxx-xxx-xxx-xxx' does not have authorization to perform action 'Microsoft.Storage/storageAccounts/listKeys/action' over scope '/subscriptions/xxx-xxx-xxx-xxx-xxx/resourceGroups/rsg-xxx-xxx-d-xxx/providers/Microsoft.Storage/storageAccounts/xxx' or the scope is invalid. If access was recently granted, please refresh your credentials."}}

It looks like it's ignoring the AzureStorageIdentityResourceID, and skilling the workload identity when not using the client_id directly. Any thoughts?

[andyzhangx]

one of the 3 parameters is used together with AzureStorageAuthType: MSI parameter, like this:

kind: StorageClass
metadata:
  name: blob-fuse
provisioner: blob.csi.azure.com
parameters:
  skuName: Premium_LRS 
  protocol: fuse
  resourceGroup: EXISTING_RESOURCE_GROUP_NAME   # optional, node resource group by default if it's not provided
  storageAccount: EXISTING_STORAGE_ACCOUNT_NAME # optional, a new account will be created if it's not provided
  containerName: EXISTING_CONTAINER_NAME  # optional, a new container will be created if it's not provided
  AzureStorageAuthType: MSI
  AzureStorageIdentityClientID: "xxxxx-xxxx-xxx-xxx-xxxxxxx"