offen/docker-volume-backup

Add option for Azure Blob Storage connection strings for authentication

bennyweise opened this issue · 4 comments

Is your feature request related to a problem? Please describe.
I'm attempting to use this to backup to Azure Blob Storage, however the two connection options don't work particularly well for me. I can't use a managed identity as I am running things in my office lab, and I would prefer not to use the primary account credentials.

Describe the solution you'd like
It would be great to be able to use an Azure Blob Storage connection string to authenticate, rather than primary account keys - primarily so we can reduce the scope of authorisation that is used for the backups.

Describe alternatives you've considered
I'm also considering backing up locally and then running something else to write to the blob store - but would prefer if it could be incorporated into docker-volume-backup.

m90 commented

I'm not an Azure user myself, so I don't know how this authentication method really works, however if you want to add the option to support it, I'm happy to merge a PR that adds it.

Documentation for the Go SDK is found here https://github.com/Azure/azure-sdk-for-go/tree/main/sdk/storage/azblob#readme

m90 commented

A code sample is found here https://github.com/Azure/azure-sdk-for-go/blob/ec67edd9006dba369e8c0ab4164b8e77cfbc2e13/sdk/storage/azblob/examples_test.go#L152-L162

Client creation in this tool is happening here:

var client *azblob.Client
if opts.PrimaryAccountKey != "" {
cred, err := azblob.NewSharedKeyCredential(opts.AccountName, opts.PrimaryAccountKey)
if err != nil {
return nil, errwrap.Wrap(err, "error creating shared key Azure credential")
}
client, err = azblob.NewClientWithSharedKeyCredential(normalizedEndpoint, cred, nil)
if err != nil {
return nil, errwrap.Wrap(err, "error creating Azure client")
}
} else {
cred, err := azidentity.NewManagedIdentityCredential(nil)
if err != nil {
return nil, errwrap.Wrap(err, "error creating managed identity credential")
}
client, err = azblob.NewClient(normalizedEndpoint, cred, nil)
if err != nil {
return nil, errwrap.Wrap(err, "error creating Azure client")
}
}

m90 commented

This is now possible in v2.39.0

Amazing, thanks so much! I had intended to have a crack at this, but hadn't yet got around to it.