Repository: kserve/kserve (language: python)

Issue:
Azure blob storage access key env not mounted
/kind bug

**What steps did you take and what happened:**
[A clear and concise description of what the bug is.]
Previously issue #2392 was done to support shared access token as credentials for azure blob storage download. The feature utilizes`AZURE_STORAGE_ACCESS_KEY` for azure blob downloads in storage-initializer. However, `AZURE_STORAGE_ACCESS_KEY` env is not injected from controller for azure blob download when other secrets are injected as well (eg. `AZURE_CLIENT_ID`)


**What did you expect to happen:**
Able to access Azure Storage resources using shared access signatures


**What's the InferenceService yaml:**
[To help us debug please run `kubectl get isvc $name -n $namespace -oyaml` and paste the output]

**Anything else you would like to add:**
[Miscellaneous information that will assist in solving the issue.]


**Environment:**

- Istio Version:
- Knative Version:
- KServe Version:
- Kubeflow version:
- Cloud Environment:[k8s_istio/istio_dex/gcp_basic_auth/gcp_iap/aws/aws_cognito/ibm]
- Minikube/Kind version:
- Kubernetes version: (use `kubectl version`):
- OS (e.g. from `/etc/os-release`):



Discussion / hints:

Fix patch:
diff --git a/pkg/credentials/azure/azure_secret.go b/pkg/credentials/azure/azure_secret.go
index 703f330cf53..af9016a3046 100644
--- a/pkg/credentials/azure/azure_secret.go
+++ b/pkg/credentials/azure/azure_secret.go
@@ -37,7 +37,7 @@ const (
 
 var (
 	LegacyAzureEnvKeys        = []string{LegacyAzureSubscriptionId, LegacyAzureTenantId, LegacyAzureClientId, LegacyAzureClientSecret}
-	AzureEnvKeys              = []string{AzureSubscriptionId, AzureTenantId, AzureClientId, AzureClientSecret}
+	AzureEnvKeys              = []string{AzureSubscriptionId, AzureTenantId, AzureClientId, AzureClientSecret, AzureStorageAccessKey}
 	legacyAzureEnvKeyMappings = map[string]string{
 		AzureSubscriptionId: LegacyAzureSubscriptionId,
 		AzureTenantId:       LegacyAzureTenantId,
@@ -54,8 +54,8 @@ func BuildSecretEnvs(secret *v1.Secret) []v1.EnvVar {
 		if _, ok := secret.Data[legacyDataKey]; ok {
 			dataKey = legacyDataKey
 		}
-		// Leave out the AzureClientSecret env var if not defined as Data in the secret
-		if _, ok := secret.Data[dataKey]; !(!ok && dataKey == AzureClientSecret) {
+		// Leave out the AzureClientSecret or AzureStorageAccessKey env var if not defined as Data in the secret
+		if _, ok := secret.Data[dataKey]; !(!ok && (dataKey == AzureClientSecret || dataKey == AzureStorageAccessKey)) {
 			envs = append(envs, v1.EnvVar{
 				Name: k,
 				ValueFrom: &v1.EnvVarSource{


Test patch:
diff --git a/pkg/credentials/azure/azure_secret_test.go b/pkg/credentials/azure/azure_secret_test.go
index 04b69b2620b..4479ae1970d 100644
--- a/pkg/credentials/azure/azure_secret_test.go
+++ b/pkg/credentials/azure/azure_secret_test.go
@@ -88,7 +88,255 @@ func TestAzureSecret(t *testing.T) {
 				},
 			},
 		},
+		"AzureSecretEnvsWithStorageAccessKey": {
+			secret: &v1.Secret{
+				ObjectMeta: metav1.ObjectMeta{
+					Name: "azcreds",
+				},
+				Data: map[string][]byte{
+					AzureSubscriptionId:   []byte("AzureSubscriptionId"),
+					AzureTenantId:         []byte("AzureTenantId"),
+					AzureClientId:         []byte("AzureClientId"),
+					AzureStorageAccessKey: []byte("AzureStorageAccessKey"),
+				},
+			},
+			expected: []v1.EnvVar{
+				{
+					Name: AzureSubscriptionId,
+					ValueFrom: &v1.EnvVarSource{
+						SecretKeyRef: &v1.SecretKeySelector{
+							LocalObjectReference: v1.LocalObjectReference{
+								Name: "azcreds",
+							},
+							Key: AzureSubscriptionId,
+						},
+					},
+				},
+				{
+					Name: AzureTenantId,
+					ValueFrom: &v1.EnvVarSource{
+						SecretKeyRef: &v1.SecretKeySelector{
+							LocalObjectReference: v1.LocalObjectReference{
+								Name: "azcreds",
+							},
+							Key: AzureTenantId,
+						},
+					},
+				},
+				{
+					Name: AzureClientId,
+					ValueFrom: &v1.EnvVarSource{
+						SecretKeyRef: &v1.SecretKeySelector{
+							LocalObjectReference: v1.LocalObjectReference{
+								Name: "azcreds",
+							},
+							Key: AzureClientId,
+						},
+					},
+				},
+				{
+					Name: AzureStorageAccessKey,
+					ValueFrom: &v1.EnvVarSource{
+						SecretKeyRef: &v1.SecretKeySelector{
+							LocalObjectReference: v1.LocalObjectReference{
+								Name: "azcreds",
+							},
+							Key: AzureStorageAccessKey,
+						},
+					},
+				},
+			},
+		},
+		"AzureSecretEnvsWithClientSecretAndStorageAccessKey": {
+			secret: &v1.Secret{
+				ObjectMeta: metav1.ObjectMeta{
+					Name: "azcreds",
+				},
+				Data: map[string][]byte{
+					AzureSubscriptionId:   []byte("AzureSubscriptionId"),
+					AzureTenantId:         []byte("AzureTenantId"),
+					AzureClientId:         []byte("AzureClientId"),
+					AzureClientSecret:     []byte("AzureClientSecret"),
+					AzureStorageAccessKey: []byte("AzureStorageAccessKey"),
+				},
+			},
+			expected: []v1.EnvVar{
+				{
+					Name: AzureSubscriptionId,
+					ValueFrom: &v1.EnvVarSource{
+						SecretKeyRef: &v1.SecretKeySelector{
+							LocalObjectReference: v1.LocalObjectReference{
+								Name: "azcreds",
+							},
+							Key: AzureSubscriptionId,
+						},
+					},
+				},
+				{
+					Name: AzureTenantId,
+					ValueFrom: &v1.EnvVarSource{
+						SecretKeyRef: &v1.SecretKeySelector{
+							LocalObjectReference: v1.LocalObjectReference{
+								Name: "azcreds",
+							},
+							Key: AzureTenantId,
+						},
+					},
+				},
+				{
+					Name: AzureClientId,
+					ValueFrom: &v1.EnvVarSource{
+						SecretKeyRef: &v1.SecretKeySelector{
+							LocalObjectReference: v1.LocalObjectReference{
+								Name: "azcreds",
+							},
+							Key: AzureClientId,
+						},
+					},
+				},
+				{
+					Name: AzureClientSecret,
+					ValueFrom: &v1.EnvVarSource{
+						SecretKeyRef: &v1.SecretKeySelector{
+							LocalObjectReference: v1.LocalObjectReference{
+								Name: "azcreds",
+							},
+							Key: AzureClientSecret,
+						},
+					},
+				},
+				{
+					Name: AzureStorageAccessKey,
+					ValueFrom: &v1.EnvVarSource{
+						SecretKeyRef: &v1.SecretKeySelector{
+							LocalObjectReference: v1.LocalObjectReference{
+								Name: "azcreds",
+							},
+							Key: AzureStorageAccessKey,
+						},
+					},
+				},
+			},
+		},
 		"AzureSecretEnvsWithoutClientSecret": {
+			secret: &v1.Secret{
+				ObjectMeta: metav1.ObjectMeta{
+					Name: "azcreds",
+				},
+				Data: map[string][]byte{
+					AzureSubscriptionId:   []byte("AzureSubscriptionId"),
+					AzureTenantId:         []byte("AzureTenantId"),
+					AzureClientId:         []byte("AzureClientId"),
+					AzureStorageAccessKey: []byte("AzureStorageAccessKey"),
+				},
+			},
+			expected: []v1.EnvVar{
+				{
+					Name: AzureSubscriptionId,
+					ValueFrom: &v1.EnvVarSource{
+						SecretKeyRef: &v1.SecretKeySelector{
+							LocalObjectReference: v1.LocalObjectReference{
+								Name: "azcreds",
+							},
+							Key: AzureSubscriptionId,
+						},
+					},
+				},
+				{
+					Name: AzureTenantId,
+					ValueFrom: &v1.EnvVarSource{
+						SecretKeyRef: &v1.SecretKeySelector{
+							LocalObjectReference: v1.LocalObjectReference{
+								Name: "azcreds",
+							},
+							Key: AzureTenantId,
+						},
+					},
+				},
+				{
+					Name: AzureClientId,
+					ValueFrom: &v1.EnvVarSource{
+						SecretKeyRef: &v1.SecretKeySelector{
+							LocalObjectReference: v1.LocalObjectReference{
+								Name: "azcreds",
+							},
+							Key: AzureClientId,
+						},
+					},
+				},
+				{
+					Name: AzureStorageAccessKey,
+					ValueFrom: &v1.EnvVarSource{
+						SecretKeyRef: &v1.SecretKeySelector{
+							LocalObjectReference: v1.LocalObjectReference{
+								Name: "azcreds",
+							},
+							Key: AzureStorageAccessKey,
+						},
+					},
+				},
+			},
+		},
+		"AzureSecretEnvsWithoutStorageAccessKey": {
+			secret: &v1.Secret{
+				ObjectMeta: metav1.ObjectMeta{
+					Name: "azcreds",
+				},
+				Data: map[string][]byte{
+					AzureSubscriptionId: []byte("AzureSubscriptionId"),
+					AzureTenantId:       []byte("AzureTenantId"),
+					AzureClientId:       []byte("AzureClientId"),
+					AzureClientSecret:   []byte("AzureClientSecret"),
+				},
+			},
+			expected: []v1.EnvVar{
+				{
+					Name: AzureSubscriptionId,
+					ValueFrom: &v1.EnvVarSource{
+						SecretKeyRef: &v1.SecretKeySelector{
+							LocalObjectReference: v1.LocalObjectReference{
+								Name: "azcreds",
+							},
+							Key: AzureSubscriptionId,
+						},
+					},
+				},
+				{
+					Name: AzureTenantId,
+					ValueFrom: &v1.EnvVarSource{
+						SecretKeyRef: &v1.SecretKeySelector{
+							LocalObjectReference: v1.LocalObjectReference{
+								Name: "azcreds",
+							},
+							Key: AzureTenantId,
+						},
+					},
+				},
+				{
+					Name: AzureClientId,
+					ValueFrom: &v1.EnvVarSource{
+						SecretKeyRef: &v1.SecretKeySelector{
+							LocalObjectReference: v1.LocalObjectReference{
+								Name: "azcreds",
+							},
+							Key: AzureClientId,
+						},
+					},
+				},
+				{
+					Name: AzureClientSecret,
+					ValueFrom: &v1.EnvVarSource{
+						SecretKeyRef: &v1.SecretKeySelector{
+							LocalObjectReference: v1.LocalObjectReference{
+								Name: "azcreds",
+							},
+							Key: AzureClientSecret,
+						},
+					},
+				},
+			},
+		},
+		"AzureSecretEnvsWithoutClientSecretAndStorageAccessKey": {
 			secret: &v1.Secret{
 				ObjectMeta: metav1.ObjectMeta{
 					Name: "azcreds",
diff --git a/pkg/credentials/service_account_credentials_test.go b/pkg/credentials/service_account_credentials_test.go
index e305b7920df..2826240273d 100644
--- a/pkg/credentials/service_account_credentials_test.go
+++ b/pkg/credentials/service_account_credentials_test.go
@@ -807,10 +807,11 @@ func TestAzureCredentialBuilder(t *testing.T) {
 			Namespace: "default",
 		},
 		Data: map[string][]byte{
-			"AZURE_SUBSCRIPTION_ID": {},
-			"AZURE_TENANT_ID":       {},
-			"AZURE_CLIENT_ID":       {},
-			"AZURE_CLIENT_SECRET":   {},
+			"AZURE_SUBSCRIPTION_ID":    {},
+			"AZURE_TENANT_ID":          {},
+			"AZURE_CLIENT_ID":          {},
+			"AZURE_CLIENT_SECRET":      {},
+			"AZURE_STORAGE_ACCESS_KEY": {},
 		},
 	}
 
@@ -887,6 +888,17 @@ func TestAzureCredentialBuilder(t *testing.T) {
 													},
 												},
 											},
+											{
+												Name: azure.AzureStorageAccessKey,
+												ValueFrom: &v1.EnvVarSource{
+													SecretKeyRef: &v1.SecretKeySelector{
+														LocalObjectReference: v1.LocalObjectReference{
+															Name: "az-custom-secret",
+														},
+														Key: azure.AzureStorageAccessKey,
+													},
+												},
+											},
 										},
 									},
 								},