Thanks to visit codestin.com
Credit goes to github.com

Skip to content

Commit b4d8bb1

Browse files
nightflight-dkwhoisj
nightflight-dk
and
whoisj
authored
Add Azure Managed Identity authentication support (#8652)
Co-authored-by: J Wyman <[email protected]>
1 parent 57d0cb3 commit b4d8bb1

2 files changed

Lines changed: 169 additions & 4 deletions

File tree

‎docs/user_guide/model_repository.md‎

Lines changed: 53 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
<!--
2-
# Copyright 2018-2025, NVIDIA CORPORATION & AFFILIATES. All rights reserved.
2+
# Copyright 2018-2026, NVIDIA CORPORATION & AFFILIATES. All rights reserved.
33
#
44
# Redistribution and use in source and binary forms, with or without
55
# modification, are permitted provided that the following conditions
@@ -175,7 +175,9 @@ For a model repository residing in Azure Storage, the repository path must be pr
175175
$ tritonserver --model-repository=as://account_name/container_name/path/to/model/repository ...
176176
```
177177

178-
When using Azure Storage, you must set the `AZURE_STORAGE_ACCOUNT` and `AZURE_STORAGE_KEY` environment variables to an account that has access to the Azure Storage repository.
178+
##### Shared Key Authentication (Default)
179+
180+
When using Azure Storage with shared key authentication, you must set the `AZURE_STORAGE_ACCOUNT` and `AZURE_STORAGE_KEY` environment variables to an account that has access to the Azure Storage repository.
179181

180182
If you don't know your `AZURE_STORAGE_KEY` and have your Azure CLI correctly configured, here's an example of how to find a key corresponding to your `AZURE_STORAGE_ACCOUNT`:
181183

@@ -184,6 +186,50 @@ $ export AZURE_STORAGE_ACCOUNT="account_name"
184186
$ export AZURE_STORAGE_KEY=$(az storage account keys list -n $AZURE_STORAGE_ACCOUNT --query "[0].value")
185187
```
186188

189+
##### Azure Managed Identity Authentication
190+
191+
Triton supports Azure Managed Identity (MI) as an alternative to shared key
192+
authentication. This eliminates the need to distribute or rotate storage account
193+
keys and aligns with enterprise security best practices on Azure.
194+
195+
To enable Managed Identity authentication, set the `AZURE_STORAGE_AUTH_TYPE`
196+
environment variable:
197+
198+
```bash
199+
$ export AZURE_STORAGE_ACCOUNT="account_name"
200+
$ export AZURE_STORAGE_AUTH_TYPE="managed_identity"
201+
$ tritonserver --model-repository=as://account_name/container_name/path/to/model/repository ...
202+
```
203+
204+
For **user-assigned Managed Identity**, additionally specify the client ID:
205+
206+
```bash
207+
$ export AZURE_STORAGE_AUTH_TYPE="managed_identity"
208+
$ export AZURE_STORAGE_CLIENT_ID="<your-managed-identity-client-id>"
209+
```
210+
211+
You may also use `AZURE_STORAGE_AUTH_TYPE="default"` to activate the Azure
212+
`DefaultAzureCredential` chain, which probes multiple credential sources in
213+
order: environment variables, managed identity, Azure CLI, and others. This is
214+
useful during local development but has slightly higher startup latency due to
215+
the probing.
216+
217+
**Prerequisites:**
218+
219+
- The Managed Identity (system- or user-assigned) must be assigned the
220+
**Storage Blob Data Reader** role (or broader) on the target storage
221+
account or container.
222+
- The Triton host (AKS pod, VM, VMSS, App Service, etc.) must have the
223+
Managed Identity assigned.
224+
- For AKS workloads, ensure that either pod identity or workload identity
225+
federation is configured so that the pod can obtain AAD tokens.
226+
227+
**Sovereign clouds:** The Azure Identity SDK respects the `AZURE_AUTHORITY_HOST`
228+
environment variable, so this authentication mode works for sovereign cloud
229+
endpoints as well.
230+
231+
##### Local Model Directory
232+
187233
By default, Triton makes a local copy of a remote model repository in a temporary folder, which is deleted after Triton server is shut down.
188234
If you would like to control where remote model repository is copied to, you may set the `TRITON_AZURE_MOUNT_DIRECTORY` environment variable to a path pointing to the existing folder on your local machine.
189235

@@ -235,6 +281,11 @@ export TRITON_CLOUD_CREDENTIAL_PATH="cloud_credential.json"
235281
"as://Account-002/Container": {
236282
"account_str": "",
237283
"account_key": ""
284+
},
285+
"as://Account-MI/Container": {
286+
"account_str": "AZURE_STORAGE_ACCOUNT",
287+
"auth_type": "managed_identity",
288+
"client_id": ""
238289
}
239290
}
240291
}

‎qa/L0_storage_azure/test.sh‎

Lines changed: 116 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
#!/bin/bash
2-
# Copyright 2020-2025, NVIDIA CORPORATION & AFFILIATES. All rights reserved.
2+
# Copyright 2020-2026, NVIDIA CORPORATION & AFFILIATES. All rights reserved.
33
#
44
# Redistribution and use in source and binary forms, with or without
55
# modification, are permitted provided that the following conditions
@@ -137,7 +137,10 @@ sleep 10
137137

138138
# Test 1 Scenarios:
139139
# 1. access blob using shared key in envs
140-
# 2. adding more scenarios in future
140+
# 2. access blob using system-assigned managed identity
141+
# 3. access blob using user-assigned managed identity
142+
# 4. access blob using DefaultAzureCredential
143+
# 5. adding more scenarios in future
141144
for ENV_VAR in "shared_key"; do
142145
SERVER_LOG=$SERVER_LOG_BASE.$ENV_VAR.log
143146
CLIENT_LOG=$CLIENT_LOG_BASE.$ENV_VAR.log
@@ -169,6 +172,117 @@ for ENV_VAR in "shared_key"; do
169172
wait $SERVER_PID
170173
done
171174

175+
# Test 2: Managed Identity authentication
176+
# Requires the test host (VM/AKS) to have a system-assigned managed identity
177+
# with Storage Blob Data Reader on the test storage account.
178+
# Skip if not running in an MI-capable environment.
179+
if [ ! -z "$TEST_AZURE_MANAGED_IDENTITY" ]; then
180+
echo -e "\n***\n*** Testing system-assigned Managed Identity\n***"
181+
182+
# Save original key and clear it so it won't be used
183+
SAVED_AZURE_STORAGE_KEY=$AZURE_STORAGE_KEY
184+
unset AZURE_STORAGE_KEY
185+
export AZURE_STORAGE_AUTH_TYPE="managed_identity"
186+
187+
SERVER_LOG=$SERVER_LOG_BASE.managed_identity_system.log
188+
CLIENT_LOG=$CLIENT_LOG_BASE.managed_identity_system.log
189+
MODEL_REPO="${AS_URL}/models"
190+
SERVER_ARGS="--model-repository=$MODEL_REPO --exit-timeout-secs=120"
191+
192+
run_server
193+
if [ "$SERVER_PID" == "0" ]; then
194+
echo -e "\n***\n*** Failed to start $SERVER with system-assigned MI\n***"
195+
cat $SERVER_LOG
196+
RET=1
197+
else
198+
set +e
199+
run_unit_tests
200+
set -e
201+
202+
kill $SERVER_PID
203+
wait $SERVER_PID
204+
fi
205+
206+
# Test 3: User-assigned Managed Identity (if client ID is provided)
207+
if [ ! -z "$AZURE_STORAGE_CLIENT_ID" ]; then
208+
echo -e "\n***\n*** Testing user-assigned Managed Identity\n***"
209+
210+
SERVER_LOG=$SERVER_LOG_BASE.managed_identity_user.log
211+
CLIENT_LOG=$CLIENT_LOG_BASE.managed_identity_user.log
212+
SERVER_ARGS="--model-repository=$MODEL_REPO --exit-timeout-secs=120"
213+
214+
run_server
215+
if [ "$SERVER_PID" == "0" ]; then
216+
echo -e "\n***\n*** Failed to start $SERVER with user-assigned MI\n***"
217+
cat $SERVER_LOG
218+
RET=1
219+
else
220+
set +e
221+
run_unit_tests
222+
set -e
223+
224+
kill $SERVER_PID
225+
wait $SERVER_PID
226+
fi
227+
else
228+
echo -e "\n***\n*** Skipping user-assigned MI test (AZURE_STORAGE_CLIENT_ID not set)\n***"
229+
fi
230+
231+
# Test 4: DefaultAzureCredential chain
232+
echo -e "\n***\n*** Testing DefaultAzureCredential\n***"
233+
export AZURE_STORAGE_AUTH_TYPE="default"
234+
unset AZURE_STORAGE_CLIENT_ID
235+
236+
SERVER_LOG=$SERVER_LOG_BASE.default_credential.log
237+
CLIENT_LOG=$CLIENT_LOG_BASE.default_credential.log
238+
SERVER_ARGS="--model-repository=$MODEL_REPO --exit-timeout-secs=120"
239+
240+
run_server
241+
if [ "$SERVER_PID" == "0" ]; then
242+
echo -e "\n***\n*** Failed to start $SERVER with DefaultAzureCredential\n***"
243+
cat $SERVER_LOG
244+
RET=1
245+
else
246+
set +e
247+
run_unit_tests
248+
set -e
249+
250+
kill $SERVER_PID
251+
wait $SERVER_PID
252+
fi
253+
254+
# Test: invalid auth_type should fail gracefully
255+
echo -e "\n***\n*** Testing invalid auth_type (expect failure)\n***"
256+
export AZURE_STORAGE_AUTH_TYPE="invalid_type"
257+
258+
SERVER_LOG=$SERVER_LOG_BASE.invalid_auth_type.log
259+
SERVER_ARGS="--model-repository=$MODEL_REPO --exit-timeout-secs=120 --exit-on-error=false"
260+
261+
run_server
262+
if [ "$SERVER_PID" != "0" ]; then
263+
# Server started — but model load should have failed. Verify the log
264+
# contains an authentication error rather than a successful load.
265+
if grep -q "Unable to create Azure filesystem client" $SERVER_LOG; then
266+
echo -e "*** invalid auth_type correctly rejected ***"
267+
else
268+
echo -e "\n***\n*** Expected auth failure with invalid auth_type\n***"
269+
cat $SERVER_LOG
270+
RET=1
271+
fi
272+
kill $SERVER_PID
273+
wait $SERVER_PID
274+
else
275+
echo -e "*** Server correctly refused to start with invalid auth_type ***"
276+
fi
277+
278+
# Restore environment for remaining tests
279+
unset AZURE_STORAGE_AUTH_TYPE
280+
unset AZURE_STORAGE_CLIENT_ID
281+
export AZURE_STORAGE_KEY=$SAVED_AZURE_STORAGE_KEY
282+
else
283+
echo -e "\n***\n*** Skipping Managed Identity tests (TEST_AZURE_MANAGED_IDENTITY not set)\n***"
284+
fi
285+
172286
# Test localization to a specified location
173287
export TRITON_AZURE_MOUNT_DIRECTORY=`pwd`/azure_localization_test
174288

0 commit comments

Comments
 (0)