Skip to content

fix(storage): re-read the Azure federated token file on every exchange #6687

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
siva-abstract-security wants to merge 3 commits into
base: main
Choose a base branch
from
+927 −0
Open

fix(storage): re-read the Azure federated token file on every exchange #6687

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
be3989f
fix(storage): re-read the Azure federated token file on every exchange
siva-abstract-security Aug 13, 2026
51f1fcb
fix(storage): narrow when the refreshing credential is used, and surv…
siva-abstract-security Aug 13, 2026
8c4b333
fix(storage): bound token exchange attempts and guard the expiry comp…
siva-abstract-security Aug 13, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 2 additions & 0 deletions quickwit/Cargo.lock
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

4 changes: 4 additions & 0 deletions quickwit/quickwit-storage/Cargo.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -48,6 +48,8 @@ azure_core = { workspace = true, optional = true }
azure_identity = { workspace = true, optional = true }
azure_storage = { workspace = true, optional = true }
azure_storage_blobs = { workspace = true, optional = true }
arc-swap = { workspace = true, optional = true }
time = { workspace = true, optional = true }

quickwit-aws = { workspace = true }
quickwit-common = { workspace = true }
Expand Down Expand Up @@ -81,6 +83,8 @@ quickwit-common = { workspace = true, features = ["testsuite"] }

[features]
azure = [
"dep:arc-swap",
"dep:time",
"azure_core",
"azure_identity",
"azure_identity/enable_reqwest_rustls",
Expand Down
6 changes: 6 additions & 0 deletions quickwit/quickwit-storage/src/object_storage/azure_blob_storage.rs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -44,6 +44,7 @@ use tokio_util::compat::FuturesAsyncReadCompatExt;
use tokio_util::io::StreamReader;
use tracing::{info, instrument, warn};

use super::azure_workload_identity::RefreshingWorkloadIdentityCredential;
use crate::debouncer::DebouncedStorage;
use crate::metrics::object_storage_get_slice_in_flight_guards;
use crate::stable_deref_bytes::into_owned_bytes;
Expand Down Expand Up @@ -184,6 +185,11 @@ impl AzureBlobStorage {
azure_storage_config.resolve_access_key()
{
StorageCredentials::access_key(storage_account_name.clone(), access_key)
} else if let Some(credential) = RefreshingWorkloadIdentityCredential::from_env() {

@chatgpt-codex-connector chatgpt-codex-connector Bot Aug 13, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2 Badge Preserve the default Azure credential fallbacks

When no access key is configured and workload-identity env vars are present, but that provider cannot produce a token before this custom cache is populated (for example, an unreadable projected token file or a misconfigured federated credential) while a later default provider such as managed identity or Azure CLI would succeed, this branch installs only the custom credential and never reaches azure_identity::create_credential(). The previous path used the SDK default credential chain, which tries later sources after token errors, so these deployments now fail every Azure storage request instead of authenticating via their configured fallback; keep the refreshing workload credential inside a fallback chain rather than replacing the whole default chain.

Useful? React with 👍 / 👎.

// `azure_identity` 0.21 caches the federated token file contents for the process
// lifetime, which breaks workload identity ~24h after startup. See the module docs
// of `azure_workload_identity`.
StorageCredentials::token_credential(Arc::new(credential))
Comment thread
siva-abstract-security marked this conversation as resolved.
} else if let Ok(credential) = azure_identity::create_credential() {
StorageCredentials::token_credential(credential)
} else {
Expand Down
Loading