PVC cloning does not work with private endpoints enabled on StorageClass

[avanschie]

PVC cloning does not work with private endpoints enabled on StorageClass

[andyzhangx]

@avanschie the azure file driver controller pod is not running on your vnet (agent nodes), so Adding my VNet's subnets to the allowed networks won't work. With private endpoint, it does not allow Public network access, that's the reason why private endpoint won't work.

Unless you allow Public network access for storage account with private endpoint, but that does not make sense for purpose of using private endpoint.

[andyzhangx]

hi @avanschie thanks for the check.

use of private endpoints is not supported due to the 'DenyAll' default network rules in the storage account's VNet settings, I have updated the pvc cloning doc: https://github.com/kubernetes-sigs/azurefile-csi-driver/tree/master/deploy/example/cloning

[andyzhangx]

the pvc cloning feature is based on azcopy, so we are seeking managed identity support on azcopy first, while azcopy does not support managed identity auth now, so we may support that in the future.

[avanschie]

Thanks for the response @andyzhangx

I verified what you said, I see that on the created storage account's network settings "Enabled from selected virtual networks and IP addresses" is selected under "Public network access". When I switch to "Enabled from all networks", the cloning works. Adding my VNet's subnets to the allowed networks with the "Enabled from selected virtual networks and IP addresses" option, the cloning does not work - shouldn't this work as well?

My understanding is that there is a public and private endpoint for the storage account. Does this mean that cloning does not even use the private endpoint but relies on the public endpoint? Am I missing something?