feat(auth): add support for DefaultAzureCredential

containers/Dockerfile.plugin

@@ -15,6 +15,7 @@ RUN go mod download
 COPY ../cmd/manager/main.go cmd/manager/main.go
 COPY ../api/ api/
 COPY ../internal/ internal/
+COPY ../pkg/ pkg/
 
 ENV GOCACHE=/root/.cache/go-build
 ENV GOMODCACHE=/go/pkg/mod

containers/Dockerfile.sidecar

@@ -24,6 +24,7 @@ ENV GOMODCACHE=/go/pkg/mod
 COPY ../cmd/manager/main.go cmd/manager/main.go
 COPY ../api/ api/
 COPY ../internal/ internal/
+COPY ../pkg/ pkg/
 
 # Build
 # the GOARCH has not a default value to allow the binary be built according to the host where the command

internal/cnpgi/common/common.go

@@ -20,13 +20,17 @@ SPDX-License-Identifier: Apache-2.0
 package common
 
 import (
+	"context"
 	"fmt"
 	"path"
 	"strings"
 
 	barmanapi "github.com/cloudnative-pg/barman-cloud/pkg/api"
+	"github.com/cloudnative-pg/barman-cloud/pkg/command"
 
+	apiv1 "github.com/cloudnative-pg/plugin-barman-cloud/api/v1"
 	"github.com/cloudnative-pg/plugin-barman-cloud/internal/cnpgi/metadata"
+	pluginmetadata "github.com/cloudnative-pg/plugin-barman-cloud/pkg/metadata"
 )
 
 // TODO: refactor.
@@ -97,3 +101,14 @@ func MergeEnv(env []string, incomingEnv []string) []string {
 func BuildCertificateFilePath(objectStoreName string) string {
 	return path.Join(metadata.BarmanCertificatesPath, objectStoreName, metadata.BarmanCertificatesFileName)
 }
+
+// ContextWithProviderOptions enriches the context with cloud service provider specific options
+// based on the ObjectStore resource
+func ContextWithProviderOptions(ctx context.Context, objectStore apiv1.ObjectStore) context.Context {
+	if objectStore.GetAnnotations()[pluginmetadata.UseDefaultAzureCredentialAnnotationName] ==
+		pluginmetadata.UseDefaultAzureCredentialTrueValue {
+		return command.ContextWithDefaultAzureCredentials(ctx, true)
+	}
+
+	return ctx
+}

internal/cnpgi/common/wal.go

@@ -127,6 +127,8 @@ func (w WALServiceImplementation) Archive(
 		return nil, err
 	}
 
+	ctx = ContextWithProviderOptions(ctx, objectStore)
+
 	envArchive, err := barmanCredentials.EnvSetCloudCredentialsAndCertificates(
 		ctx,
 		w.Client,

internal/cnpgi/instance/backup.go

@@ -87,6 +87,8 @@ func (b BackupServiceImplementation) Backup(
 		return nil, err
 	}
 
+	ctx = common.ContextWithProviderOptions(ctx, objectStore)
+
 	if err := fileutils.EnsureDirectoryExists(postgres.BackupTemporaryDirectory); err != nil {
 		contextLogger.Error(err, "Cannot create backup temporary directory", "err", err)
 		return nil, err

internal/cnpgi/instance/retention.go

@@ -93,6 +93,8 @@ func (c *CatalogMaintenanceRunnable) cycle(ctx context.Context) (time.Duration,
 		return 0, err
 	}
 
+	ctx = common.ContextWithProviderOptions(ctx, barmanObjectStore)
+
 	if err := c.maintenance(ctx, &cluster, &barmanObjectStore); err != nil {
 		return 0, err
 	}

internal/cnpgi/restore/restore.go

@@ -109,7 +109,7 @@ func (impl JobHookImpl) Restore(
 		}
 
 		if err := impl.checkBackupDestination(
-			ctx,
+			common.ContextWithProviderOptions(ctx, targetObjectStore),
 			configuration.Cluster,
 			&targetObjectStore.Spec.Configuration,
 			targetObjectStore.Name,
@@ -118,6 +118,8 @@ func (impl JobHookImpl) Restore(
 		}
 	}
 
+	ctx = common.ContextWithProviderOptions(ctx, recoveryObjectStore)
+
 	// Detect the backup to recover
 	backup, env, err := loadBackupObjectFromExternalCluster(
 		ctx,

pkg/metadata/doc.go

@@ -0,0 +1,2 @@
+// Package metadata provides metadata utilities for the Barman Cloud plugin
+package metadata

pkg/metadata/labels_annotations.go

@@ -0,0 +1,15 @@
+package metadata
+
+// MetadataNamespace is the namespace used for the Barman Cloud plugin metadata
+const MetadataNamespace = "barmancloud.cnpg.io"
+
+const (
+	// UseDefaultAzureCredentialAnnotationName is an annotation that can be set
+	// on an ObjectStore resource to enable the authentication to Azure via DefaultAzureCredential.
+	// This is meant to be used with inheritFromAzureAD enabled.
+	UseDefaultAzureCredentialAnnotationName = MetadataNamespace + "/useDefaultAzureCredential"
+
+	// UseDefaultAzureCredentialTrueValue is the value for the annotation
+	// barmancloud.cnpg.io/useDefaultAzureCredential to enable the DefaultAzureCredentials auth mechanism.
+	UseDefaultAzureCredentialTrueValue = "true"
+)

web/docs/object_stores.md

@@ -233,6 +233,7 @@ Barman Cloud supports the following authentication methods:
 - Storage Account Name + [Access Key](https://learn.microsoft.com/en-us/azure/storage/common/storage-account-keys-manage)
 - Storage Account Name + [SAS Token](https://learn.microsoft.com/en-us/azure/storage/blobs/sas-service-create)
 - [Azure AD Workload Identity](https://azure.github.io/azure-workload-identity/docs/introduction.html)
+- [DefaultAzureCredential](https://learn.microsoft.com/en-us/azure/developer/go/sdk/authentication/credential-chains#defaultazurecredential-overview)
 
 ### Azure AD Workload Identity
 
@@ -252,6 +253,27 @@ spec:
   [...]
 ```
 
+### DefaultAzureCredential
+
+To authenticate using `DefaultAzureCredential`, set the annotation
+`barmancloud.cnpg.io/useDefaultAzureCredential="true"` on the ObjectStore in
+conjunction with the `.spec.configuration.inheritFromAzureAD` option:
+
+```yaml
+apiVersion: barmancloud.cnpg.io/v1
+kind: ObjectStore
+metadata:
+  name: azure-store
+  annotations:
+    barmancloud.cnpg.io/useDefaultAzureCredential: "true"
+spec:
+  configuration:
+    destinationPath: "<destination path here>"
+    azureCredentials:
+      inheritFromAzureAD: true
+  [...]
+```
+
 ### Access Key, SAS Token, or Connection String
 
 Store credentials in a Kubernetes secret: