Use of MSI / SPN / AZCLI

[rajsshah86]

Hi
I have few questions :
We have Premium storage account of type BlockBlob storage and HNS enabled.

• What should be the Endpoint value in the config file ? should it be blob or dfs ? The type set is adls . In the logs it seems like it uses dfs endpoint even if we mention blob endpoint .
• The MSI login option : does this only applicable to the case where the MSI is assigned to an azure resource like VM ? Because a user defined msi also supports federated credentials . How can we use that to login via msi and use blobfuse ?
• For SPN authentication as well , is there a way to authenticate via OIDC (federated credentials) ?
• When is the plan to release the azcli login option ? I can see that it has not officially been released yet even though the code is there :) )

[souravgupta-msft]

Hi @rajsshah86. Thanks for reaching out. Please find the reply below.

• If the account type is adls, then the endpoint should be dfs. If adls is set as account type and you haven't specified the endpoint field in the config, it is auto computed to accountName.dfs.core.windows.net. And if you have specified blob endpoint for adls accounts, then it is corrected to its respective dfs endpoint.
• For user assigned MI, you can assign it to the Azure VM and in the config file, you can mention its appid in the azstorage section. Please try this with the latest release of blobfuse2.
• Can you give more details on what you mean by OIDC (federated credentials). For SPN, there is an option called oauth-token-path which points to the file where token is stored. It creates a workload identity credential which is generally used in AKS workspace. Can you check if this option works out for you.
• The azcli auth mode is merged in the main branch and the next release will have this feature, which will done around mid of May.

[souravgupta-msft]

I will try this out. However, I think it is not supported in blobfuse currently.

[rajsshah86]

@souravgupta-msft : Thanks , I will wait for your response .

Meanwhile , I have a feeling that above approach( Login using github action via MSI or SPN ) and then using blobfuse might work when I put mode as azcli in the config file ??

[souravgupta-msft]

Yes, azcli auth mode should work for your scenario. It basically runs, az account get-access-token command. If this command runs successfully in the runner, then the blobfuse mount will also work.

[rajsshah86]

@souravgupta-msft : In that case I will have to wait for azcli mode to get officially released . However one more question then comes out of it , what will happen if i have a long running job ( more than an hour ) which is using the blobfuse2 mountpoint and the token gets expired.

[souravgupta-msft]

If token has expired, the token refresh logic will be executed where get-access-token command will be run to fetch the new token.