From ad0d3b06d86ce65f0d82ea079ed0220a12987eab Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Diego=20Fernando=20Carri=C3=B3n?= <diego@crthaze.com>
Date: Mon, 27 Jul 2026 14:11:33 +0200
Subject: [PATCH] Fix azureblob keyless auth: always emit jclouds.credential
 (#27)

S3Proxy requires both jclouds.identity and jclouds.credential in every
backend properties file; only filesystem-nio2, transient-nio2 and
google-cloud-storage-sdk are exempt from that check in Main.java. The
azureblob backend defaults to the azureblob-sdk provider, which is NOT
exempt, so when it authenticates via Azure Workload Identity (account
set, no storage account key) the rendered properties file omitted
jclouds.credential entirely and S3Proxy exited on startup with:

    Properties file must contain: jclouds.identity and jclouds.credential

Emit an empty `jclouds.credential=` whenever no storage account key is
provided. This keys off key.value alone (not key.value OR sasToken.value),
which also covers the SAS-token-only path: SAS auth carries the token via
jclouds.azureblob.sas but never sets jclouds.credential, so it hit the
same startup failure.

Verified with `helm template` for workload-identity, SAS-only, and
key-based configs. Chart version bumped 0.4.0 -> 0.4.1.

Fixes #27
---
 charts/s3proxy/Chart.yaml               |  2 +-
 charts/s3proxy/templates/configmap.yaml | 10 ++++++++--
 2 files changed, 9 insertions(+), 3 deletions(-)

diff --git a/charts/s3proxy/Chart.yaml b/charts/s3proxy/Chart.yaml
index df94141..d1b0a67 100644
--- a/charts/s3proxy/Chart.yaml
+++ b/charts/s3proxy/Chart.yaml
@@ -15,7 +15,7 @@ type: application
 # This is the chart version. This version number should be incremented each time you make changes
 # to the chart and its templates, including the app version.
 # Versions are expected to follow Semantic Versioning (https://semver.org/)
-version: 0.4.0
+version: 0.4.1
 
 # This is the version number of the application being deployed. This version number should be
 # incremented each time you make changes to the application. Versions are not expected to
diff --git a/charts/s3proxy/templates/configmap.yaml b/charts/s3proxy/templates/configmap.yaml
index e0d8803..3a633f3 100644
--- a/charts/s3proxy/templates/configmap.yaml
+++ b/charts/s3proxy/templates/configmap.yaml
@@ -177,8 +177,14 @@ data:
   {{- if .Values.config.backends.azureblob.account }}
     jclouds.identity={{ .Values.config.backends.azureblob.account }}
   {{- end }}
-  {{- if or .Values.config.backends.azureblob.key.value .Values.config.backends.azureblob.sasToken.value }}
-    # Credentials will be merged from the secret properties file
+  {{- /* When a storage account key is set, jclouds.credential is merged in from the
+         Secret. Otherwise the azureblob-sdk provider authenticates with the SAS token
+         (jclouds.azureblob.sas, merged from the Secret) or the ambient Azure Workload
+         Identity credentials injected into the pod. S3Proxy still requires
+         jclouds.credential in every backend properties file (only filesystem-nio2,
+         transient-nio2 and google-cloud-storage-sdk are exempt), so emit it empty. */}}
+  {{- if not .Values.config.backends.azureblob.key.value }}
+    jclouds.credential=
   {{- end }}
   {{- range $index, $bucket := .Values.config.backends.azureblob.bucketLocators }}
     s3proxy.bucket-locator.{{ add $index 1 }}={{ $bucket }}