Merge pull request #431 from oukoedwin/edwinouko/agc-image-provisioning

Add Azure Storage Blob as an image source

Author: oukoedwin

pkg/redact/redact.go

@@ -152,7 +152,7 @@ func redactJsonSensitiveField(val reflect.Value) {
 		return
 	}
 
-	sensitiveKeys := [...]string{"private-key", "sasURI"}
+	sensitiveKeys := [...]string{"private-key", "sasURI", "endpoint"}
 
 	for _, sensitiveKey := range sensitiveKeys {
 		if _, ok := jsonData[sensitiveKey]; ok {
@@ -256,7 +256,7 @@ func redactErrorJsonSensitiveField(val reflect.Value, errMessage *error) {
 	if err := json.Unmarshal([]byte(val.String()), &jsonData); err != nil {
 		return
 	}
-	sensitiveKeys := [...]string{"private-key", "sasURI"}
+	sensitiveKeys := [...]string{"private-key", "sasURI", "endpoint"}
 
 	for _, sensitiveKey := range sensitiveKeys {
 		if strVal, ok := jsonData[sensitiveKey].(string); ok && errMessage != nil && *errMessage != nil && strVal != "" {

pkg/redact/redact_test.go

@@ -252,3 +252,19 @@ func TestRedactErrorURL(t *testing.T) {
 		})
 	}
 }
+
+func TestRedactJsonSensitiveField_Endpoint(t *testing.T) {
+	endpoint := "https://mystorage.blob.core.windows.net"
+	jsonStr := fmt.Sprintf(`{"cloud":"AzureCloud","endpoint":"%s","catalogName":"cat"}`, endpoint)
+
+	val := reflect.ValueOf(&jsonStr).Elem()
+	redactJsonSensitiveField(val)
+
+	assert.False(t, strings.Contains(val.String(), endpoint),
+		"endpoint should be redacted, got: %s", val.String())
+	assert.True(t, strings.Contains(val.String(), RedactedString),
+		"redacted value should contain placeholder, got: %s", val.String())
+	// Other fields should remain intact
+	assert.True(t, strings.Contains(val.String(), "AzureCloud"),
+		"non-sensitive fields should be preserved, got: %s", val.String())
+}

rpc/cloudagent/compute/galleryimage/moc_cloudagent_galleryimage.proto

@@ -58,6 +58,15 @@ message AzureGalleryImageProperties {
 	string sasURI = 1 [(sensitive) = true];
 	string version = 2;
 }
+message AzureBlobImageProperties {
+	string catalogName = 1;
+	string audience = 2;
+	string version = 3;
+	string releaseName = 4;
+	uint32 parts = 5;
+	string cloud = 6;
+	string endpoint = 7;
+}
 
 message GalleryImage {
 	string name = 1;

rpc/cloudagent/compute/moc_cloudagent_galleryimage.pb.go

@@ -0,0 +1,42 @@
+// Copyright (c) Microsoft Corporation.
+// Licensed under the Apache v2.0 license.
+package compute
+
+import (
+	"encoding/json"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+// TestAzureBlobImageProperties_JSONKeys locks the exact JSON keys produced by
+// the cloudagent AzureBlobImageProperties message. moc-sdk-for-go marshals
+// this struct into GalleryImage.sourcePath as the on-the-wire representation
+// of AGC (AZURESTORAGEBLOB_SOURCE) image provisioning parameters. Renaming any
+// of these proto fields would silently break the encoding agreement with
+// wssdagent's parseBlobConfig on the decode side, so this test fails loudly
+// if a field name drifts.
+func TestAzureBlobImageProperties_JSONKeys(t *testing.T) {
+	props := AzureBlobImageProperties{
+		CatalogName: "cat",
+		Audience:    "aud",
+		Version:     "v1",
+		ReleaseName: "rel",
+		Parts:       4,
+		Cloud:       "AzureCloud",
+		Endpoint:    "https://example.blob.core.windows.net",
+	}
+	raw, err := json.Marshal(&props)
+	require.NoError(t, err)
+
+	var m map[string]any
+	require.NoError(t, json.Unmarshal(raw, &m))
+
+	expected := []string{"catalogName", "audience", "version", "releaseName", "parts", "cloud", "endpoint"}
+	for _, key := range expected {
+		_, ok := m[key]
+		assert.True(t, ok, "missing JSON key %q (renamed proto field?)", key)
+	}
+	assert.Len(t, m, len(expected), "unexpected extra/missing JSON keys: %v", m)
+}