fix: allow disabling Key Vault auth challenge resource verification - #2047
Open
cizji wants to merge 1 commit into
Open
fix: allow disabling Key Vault auth challenge resource verification#2047cizji wants to merge 1 commit into
cizji wants to merge 1 commit into
Conversation
The Key Vault SDK clients (azsecrets/azkeys/azcertificates) were constructed with nil ClientOptions, so there was no way to set DisableChallengeResourceVerification. On non-standard vault URIs (e.g. some Azure Stack Hub deployments), the SDK's challenge resource check can fail mounts with: challenge resource "..." doesn't match the requested domain. Set DisableChallengeResourceVerification to true in your client options to disable. Add a disableChallengeResourceVerification SecretProviderClass parameter that is threaded through to each Key Vault client's ClientOptions. Fixes Azure#2044
cizji
requested review from
Anish Ramasekar (aramase) and
Mo Khan (enj)
as code owners
July 9, 2026 15:27
|
Azure Pipelines: There may be pipelines that require an authorized user to comment /azp run to run. |
Author
|
@microsoft-github-policy-service agree |
|
Please up Anish Ramasekar (@aramase) or Mo Khan (@enj) to make this working with azure stack hub |
|
Anish Ramasekar (@aramase) Mo Khan (@enj) This fix is needed on our side as well, could you please review it? Thanks :) |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
azsecrets/azkeys/azcertificates) validate that the authentication challenge resource returned by Key Vault/Managed HSM matches the vault's domain. This provider constructed those clients withnilClientOptions, so there was no way to setDisableChallengeResourceVerification, breaking mounts on some non-standard vault URIs (e.g. certain Azure Stack Hub deployments) with:disableChallengeResourceVerificationSecretProviderClassparameter (default"false", matching prior behavior) that is threaded throughprovider.go->mountConfig->keyvault.NewClient, which now setsDisableChallengeResourceVerificationin theClientOptionsof all three Key Vault clients.Test plan
go build ./...go test ./pkg/provider/...(two pre-existing, Windows-path-related test failures unrelated to this change, verified to also fail onmasterwithout this diff)TestGetDisableChallengeResourceVerificationunit test covering true/false/empty/invalid values