Azure: add option to force use of CLI credential#4799
Azure: add option to force use of CLI credential#4799MichaelEischer merged 2 commits intorestic:masterfrom
Conversation
bf9d703 to
90993b0
Compare
MichaelEischer
left a comment
There was a problem hiding this comment.
Adding the environment variable seems ok, I didn't find any easy workarounds to ignore the managed identity.
I have a few comments though, see below.
90993b0 to
e1496e2
Compare
e1496e2 to
c56ecec
Compare
MichaelEischer
left a comment
There was a problem hiding this comment.
LGTM. I've rebased the PR and added a commit to deduplicate the CLI and default credentials case.
|
@MichaelEischer Any chance to cut a new release with this? Thanks! :) |
|
It will still take a few weeks as I want to first wrap up the |
|
@MichaelEischer Sorry to be a pain, do you think 0.17.0 will be out by end of next week? We're rolling out an internal policy that will prevent key-based access to storage accounts and without this PR we won't be able to use restic anymore for certain Azure VM scenarios. |
Definitely not before end of next week, a release at the end of next week might be possible, but is somewhat unlikely. There are a few more changes necessary for the |
|
@letmaik Can you please use the latest master build instead, temporarily until the new version is out? It contains the changes you are looking for and is otherwise what would be the next release (except any additional changes between now and the release, of course). It's at https://beta.restic.net/latest/ . |
|
I've noticed that cherry-picking the PR for a 0.16.5 patch release works. So we can include the change in a release earlier than expected. |
|
@letmaik 0.16.5 has been released: https://github.com/restic/restic/releases/tag/v0.16.5 |
|
@MichaelEischer Thanks a lot, that's extremely helpful! :) |
What does this PR change? What problem does it solve?
In Azure, VMs can have multiple identities at the same time, for example a managed identity and an Azure CLI identity. Sometimes the managed identity is not under control of the user but the user can still login with the Azure CLI. In those cases, being able to use the Azure CLI identity with restic makes sense.
DefaultAzureCredentialfirst tries environment variables, managed identity, workload identity, and eventually Azure CLI identity. This PR introduces a new environment variable that forces use of the Azure CLI identity:Was the change previously discussed in an issue or on the forum?
Checklist
changelog/unreleased/that describes the changes for our users (see template).gofmton the code in all commits.