Azure STS | Support the standardized Azure Identity

Signed-off-by: Naveen Paul <napaul@redhat.com>

Author: naveenpaul1

deploy/crds/noobaa.io_backingstores.yaml

@@ -87,6 +87,14 @@ spec:
               azureBlob:
                 description: AzureBlob specifies a backing store of type azure-blob
                 properties:
+                  clientId:
+                    description: Azure STS managed identity client id allows to get
+                      access token using NewWorkloadIdentityCredential
+                    type: string
+                  resourcegroupId:
+                    description: Azure storage account is created under this resource
+                      group
+                    type: string
                   secret:
                     description: |-
                       Secret refers to a secret that provides the credentials
@@ -102,12 +110,19 @@ spec:
                         type: string
                     type: object
                     x-kubernetes-map-type: atomic
+                  subscriptionId:
+                    description: Azure SubscriptionId is used to create storage account
+                      client.
+                    type: string
                   targetBlobContainer:
                     description: TargetBlobContainer is the name of the target Azure
                       Blob container
                     type: string
+                  tenantId:
+                    description: Azure STS managed identity TenantId id allows to
+                      get access token using NewWorkloadIdentityCredential
+                    type: string
                 required:
-                - secret
                 - targetBlobContainer
                 type: object
               googleCloudStorage:

deploy/crds/noobaa.io_namespacestores.yaml

@@ -90,6 +90,14 @@ spec:
               azureBlob:
                 description: AzureBlob specifies a namespace store of type azure-blob
                 properties:
+                  clientId:
+                    description: Azure STS managed identity client id allows to get
+                      access token using NewWorkloadIdentityCredential
+                    type: string
+                  resourcegroupId:
+                    description: Azure storage account is created under this resource
+                      group
+                    type: string
                   secret:
                     description: |-
                       Secret refers to a secret that provides the credentials
@@ -105,12 +113,19 @@ spec:
                         type: string
                     type: object
                     x-kubernetes-map-type: atomic
+                  subscriptionId:
+                    description: Azure SubscriptionId is used to create storage account
+                      client.
+                    type: string
                   targetBlobContainer:
                     description: TargetBlobContainer is the name of the target Azure
                       Blob container
                     type: string
+                  tenantId:
+                    description: Azure STS managed identity TenantId id allows to
+                      get access token using NewWorkloadIdentityCredential
+                    type: string
                 required:
-                - secret
                 - targetBlobContainer
                 type: object
               googleCloudStorage:

deploy/crds/noobaa.io_noobaas.yaml

@@ -1439,6 +1439,14 @@ spec:
                   azureBlob:
                     description: AzureBlob specifies a backing store of type azure-blob
                     properties:
+                      clientId:
+                        description: Azure STS managed identity client id allows to
+                          get access token using NewWorkloadIdentityCredential
+                        type: string
+                      resourcegroupId:
+                        description: Azure storage account is created under this resource
+                          group
+                        type: string
                       secret:
                         description: |-
                           Secret refers to a secret that provides the credentials
@@ -1454,12 +1462,19 @@ spec:
                             type: string
                         type: object
                         x-kubernetes-map-type: atomic
+                      subscriptionId:
+                        description: Azure SubscriptionId is used to create storage
+                          account client.
+                        type: string
                       targetBlobContainer:
                         description: TargetBlobContainer is the name of the target
                           Azure Blob container
                         type: string
+                      tenantId:
+                        description: Azure STS managed identity TenantId id allows
+                          to get access token using NewWorkloadIdentityCredential
+                        type: string
                     required:
-                    - secret
                     - targetBlobContainer
                     type: object
                   googleCloudStorage:

deploy/internal/deployment-endpoint.yaml

@@ -42,7 +42,8 @@ spec:
             secretName: noobaa-iam-serving-cert
             optional: true
         # This service account token can be used to provide identity outside the cluster.
-        # For example, this token can be used with AssumeRoleWithWebIdentity to authenticate with AWS using IAM OIDC provider and STS.
+        # For example, this token can be used with AWS(AssumeRoleWithWebIdentity)/Azure(WorkloadIdentityCredential) 
+        # to authenticate with AWS/Azure using IAM OIDC provider and STS.
         - name: bound-sa-token
           projected:
             sources:

deploy/internal/statefulset-core.yaml

@@ -35,7 +35,8 @@ spec:
             secretName: noobaa-server
             optional: true
         # This service account token can be used to provide identity outside the cluster.
-        # For example, this token can be used with AssumeRoleWithWebIdentity to authenticate with AWS using IAM OIDC provider and STS.
+        # For example, this token can be used with AWS(AssumeRoleWithWebIdentity)/Azure(WorkloadIdentityCredential) 
+        # to authenticate with AWS/Azure using IAM OIDC provider and STS.
         - name: bound-sa-token
           projected:
             sources:

deploy/operator.yaml

@@ -22,7 +22,8 @@ spec:
           type: RuntimeDefault
       volumes:
       # This service account token can be used to provide identity outside the cluster.
-      # For example, this token can be used with AssumeRoleWithWebIdentity to authenticate with AWS using IAM OIDC provider and STS.
+      # For example, this token can be used with AWS(AssumeRoleWithWebIdentity)/Azure(WorkloadIdentityCredential) 
+      # to authenticate with AWS/Azure using IAM OIDC provider and STS.
       - name: bound-sa-token
         projected:
           sources:

go.mod

@@ -10,10 +10,10 @@ replace (
 
 require (
 	cloud.google.com/go/storage v1.57.2
-	github.com/Azure/azure-sdk-for-go v68.0.0+incompatible
+	github.com/Azure/azure-sdk-for-go/sdk/azcore v1.20.0
+	github.com/Azure/azure-sdk-for-go/sdk/azidentity v1.13.1
+	github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/storage/armstorage v1.8.1
 	github.com/Azure/azure-storage-blob-go v0.15.0
-	github.com/Azure/go-autorest/autorest v0.11.30
-	github.com/Azure/go-autorest/autorest/adal v0.9.23
 	github.com/IBM/keyprotect-go-client v0.15.1
 	github.com/asaskevich/govalidator v0.0.0-20230301143203-a9d515a09cc2
 	github.com/aws/aws-sdk-go v1.48.12
@@ -32,7 +32,7 @@ require (
 	github.com/onsi/ginkgo/v2 v2.27.2
 	github.com/onsi/gomega v1.38.2
 	github.com/openshift/api v0.0.0-20251120040117-916c7003ed78
-	github.com/openshift/cloud-credential-operator v0.0.0-20231004191224-abdf0627a0cf
+	github.com/openshift/cloud-credential-operator v0.0.0-20251215212231-8f1a631d825f
 	github.com/openshift/custom-resource-status v1.1.3-0.20220503160415-f2fdb4999d87
 	github.com/operator-framework/api v0.36.0
 	github.com/operator-framework/operator-lib v0.19.0
@@ -71,12 +71,10 @@ require (
 	cloud.google.com/go/auth v0.17.0 // indirect
 	cloud.google.com/go/auth/oauth2adapt v0.2.8 // indirect
 	cloud.google.com/go/monitoring v1.24.3 // indirect
-	github.com/Azure/azure-sdk-for-go/sdk/azcore v1.20.0 // indirect
-	github.com/Azure/azure-sdk-for-go/sdk/azidentity v1.13.1 // indirect
+	github.com/Azure/azure-pipeline-go v0.2.3 // indirect
 	github.com/Azure/azure-sdk-for-go/sdk/internal v1.11.2 // indirect
 	github.com/Azure/azure-sdk-for-go/sdk/keyvault/azsecrets v0.12.0 // indirect
 	github.com/Azure/azure-sdk-for-go/sdk/keyvault/internal v0.7.1 // indirect
-	github.com/Azure/go-autorest/autorest/to v0.4.0 // indirect
 	github.com/AzureAD/microsoft-authentication-library-for-go v1.6.0 // indirect
 	github.com/GoogleCloudPlatform/opentelemetry-operations-go/detectors/gcp v1.30.0 // indirect
 	github.com/GoogleCloudPlatform/opentelemetry-operations-go/exporter/metric v0.54.0 // indirect
@@ -116,6 +114,7 @@ require (
 	github.com/hashicorp/vault/api/auth/kubernetes v0.8.0 // indirect
 	github.com/k8snetworkplumbingwg/network-attachment-definition-client v1.7.7 // indirect
 	github.com/kylelemons/godebug v1.1.0 // indirect
+	github.com/mattn/go-ieproxy v0.0.1 // indirect
 	github.com/mxk/go-flowrate v0.0.0-20140419014527-cca7078d478f // indirect
 	github.com/pkg/browser v0.0.0-20240102092130-5ac0b6a4141c // indirect
 	github.com/planetscale/vtprotobuf v0.6.1-0.20240319094008-0393e58bdf10 // indirect
@@ -136,7 +135,6 @@ require (
 	go.yaml.in/yaml/v2 v2.4.3 // indirect
 	go.yaml.in/yaml/v3 v3.0.4 // indirect
 	golang.org/x/sync v0.18.0 // indirect
-	golang.org/x/tools/go/expect v0.1.1-deprecated // indirect
 	gopkg.in/evanphx/json-patch.v4 v4.13.0 // indirect
 	k8s.io/gengo/v2 v2.0.0-20250604051438-85fd79dbfd9f // indirect
 	sigs.k8s.io/randfill v1.0.0 // indirect
@@ -147,13 +145,7 @@ require (
 	cloud.google.com/go v0.123.0 // indirect
 	cloud.google.com/go/compute/metadata v0.9.0 // indirect
 	cloud.google.com/go/iam v1.5.3 // indirect
-	github.com/Azure/azure-pipeline-go v0.2.3 // indirect
 	github.com/Azure/go-ansiterm v0.0.0-20250102033503-faa5f7b0171c // indirect
-	github.com/Azure/go-autorest v14.2.0+incompatible // indirect
-	github.com/Azure/go-autorest/autorest/date v0.3.0 // indirect
-	github.com/Azure/go-autorest/autorest/validation v0.3.1 // indirect
-	github.com/Azure/go-autorest/logger v0.2.1 // indirect
-	github.com/Azure/go-autorest/tracing v0.6.0 // indirect
 	github.com/MakeNowJust/heredoc v1.0.0 // indirect
 	github.com/ansel1/merry v1.8.0 // indirect
 	github.com/ansel1/merry/v2 v2.2.0 // indirect
@@ -197,7 +189,6 @@ require (
 	github.com/liggitt/tabwriter v0.0.0-20181228230101-89fcab3d43de // indirect
 	github.com/marstr/collection v1.0.1 // indirect
 	github.com/mattn/go-colorable v0.1.14 // indirect
-	github.com/mattn/go-ieproxy v0.0.1 // indirect
 	github.com/mattn/go-isatty v0.0.20 // indirect
 	github.com/mgutz/ansi v0.0.0-20200706080929-d51e80ef957d // indirect
 	github.com/mitchellh/go-homedir v1.1.0 // indirect