Java service running in AKS to access storage blob using system assigned maanaged Identity

Question

Our Application is running inside AKS, and using System assigned Managed Identity, we want app running in AKS to access excel files present in Azure Storage blob using Java.

We added Role of Storage Blob Reade/Owner etc in Storage accounts for AKS cluster. However, this doesn't work. Can you please help with steps to get this working. Thanks!

Code below,

  DefaultAzureCredential defaultAzureCredential=new DefaultAzureCredentialBuilder().build();
  BlobServiceClient blobServiceClient=new BlobServiceClientBuilder().credential(defaultAzureCredential).endpoint("url of blob endpoint")buildClient();
BlobContainerClient blobContainerClient=blobServiceClient.getBlobContainerClient(containerName);
 

Answer 1

I have reproduced your requirement by deploying my spring boot application which performs file uploading and downloading to Azure storage container using below code.

@PostMapping("/upload")
public  void  uploadFile(@RequestParam(value  =  "file")  MultipartFile  file)  throws  IOException  {

// Code To Create and File In Blob Storage
String  str = "DefaultEndpointsProtocol=https;AccountName=<storage_account_name>;AccountKey=storage_account_access_key;EndpointSuffix=core.windows.net";
OffsetDateTime  expiryTime  =  OffsetDateTime.now().plusDays(1);
BlobSasPermission  permission  =  new  BlobSasPermission().setReadPermission(true);
BlobServiceSasSignatureValues  values  =  new  BlobServiceSasSignatureValues(expiryTime,  permission).setStartTime(OffsetDateTime.now());
BlobContainerClient  container  =  new  BlobContainerClientBuilder().connectionString(str).containerName("<conatiner_name>").buildClient();
BlobClient  blob  =  container.getBlobClient(file.getOriginalFilename());
blob.upload(file.getInputStream(),  file.getSize(),  true);
String  sasToken  =  blob.generateSas(values);
// Code To Create and File In Blob Storage

// Code To download the File From Blob Storage
URL  url  =  new  URL(blob.getBlobUrl()  +  "?"  +  sasToken);
HttpURLConnection  httpConn  =  (HttpURLConnection)  url.openConnection();
int  responseCode  =  httpConn.getResponseCode();
// Check if the response code is HTTP_OK (200)
if  (responseCode  ==  HttpURLConnection.HTTP_OK)  {
// Open input stream from the HTTP connection
InputStream  inputStream  =  httpConn.getInputStream();
// Open output stream to save the file
FileOutputStream  outputStream  =  new FileOutputStream("Path_to_download_file");
// Read bytes from input stream and write to output stream
int  bytesRead;
byte[]  buffer  =  new  byte[4096];
while  ((bytesRead  =  inputStream.read(buffer))  !=  -1)  {
outputStream.write(buffer,  0,  bytesRead);
}
// Close streams
outputStream.close();
inputStream.close();
System.out.println("File downloaded");
}  else  {
System.out.println("Failed to download file: "  +  httpConn.getResponseMessage());
}
httpConn.disconnect();
// Code To download the File From Blob Storage
}

I have deployed my spring boot application on Azure kubernetes service as shown below and it is successfully running.

I am accessing the application by hitting the External IP of my application. I could get 200 OK response.

After hitting the API, I have checked the pod logs using kubetcl logs pod_name and I could see the file is downloaded successfully.