Repository: kubernetes-sigs/cloud-provider-azure
Pull request #3115 (2023-01-13 03:10:43)

feat: support data protection for blob csi driver
<!--  Thanks for sending a pull request!  Here are some tips for you:

1. If this is your first time, please read our contributor guidelines: https://git.k8s.io/community/contributors/guide/first-contribution.md#your-first-contribution and developer guide https://git.k8s.io/community/contributors/devel/development.md#development-guide
2. Please label this pull request according to what type of issue you are addressing, especially if this is a release targeted pull request. For reference on required PR/issue labels, read here:
https://git.k8s.io/community/contributors/devel/sig-release/release.md#issuepr-kind-label
3. Ensure you have added or ran the appropriate tests for your PR: https://git.k8s.io/community/contributors/devel/sig-testing/testing.md
4. If you want *faster* PR reviews, read how: https://git.k8s.io/community/contributors/guide/pull-requests.md#best-practices-for-faster-reviews
5. If the PR is unfinished, see how to mark it: https://git.k8s.io/community/contributors/guide/pull-requests.md#marking-unfinished-pull-requests
-->

#### What type of PR is this?
/kind feature
<!--
Add one of the following kinds:
/kind bug
/kind cleanup
/kind documentation
/kind feature
/kind design

Optionally add one or more of the following kinds if applicable:
/kind api-change
/kind deprecation
/kind failing-test
/kind flake
/kind regression
-->

#### What this PR does / why we need it:
support data protection for blob csi driver
#### Which issue(s) this PR fixes:
<!--
*Automatically closes linked issue when PR is merged.
Usage: `Fixes #<issue number>`, or `Fixes (paste link of issue)`.
_If PR is about `failing-tests or flakes`, please post the related issues/tests in a comment and do not use `Fixes`_*
-->
Fixes #

#### Special notes for your reviewer:

#### Does this PR introduce a user-facing change?
<!--
If no, just write "NONE" in the release-note block below.
If yes, a release note is required:
Enter your extended release note in the block below. If the PR requires additional action from users switching to the new release, include the string "action required".

For more information on release notes see: https://git.k8s.io/community/contributors/guide/release-notes.md
-->
```release-note
support data protection for blob csi driver
```

#### Additional documentation e.g., KEPs (Kubernetes Enhancement Proposals), usage docs, etc.:

<!--
This section can be blank if this pull request does not require a release note.

When adding links which point to resources within git repositories, like
KEPs or supporting documentation, please reference a specific commit and avoid
linking directly to the master branch. This ensures that links reference a
specific point in time, rather than a document that may change over time.

See here for guidance on getting permanent links to files: https://help.github.com/en/articles/getting-permanent-links-to-files

Please use the following format for linking documentation:
- [KEP]: <link>
- [Usage]: <link>
- [Other doc]: <link>
-->
```docs

```


k8s-ci-robot: [APPROVALNOTIFIER] This PR is **NOT APPROVED**

This pull-request has been approved by: *<a href="https://github.com/kubernetes-sigs/cloud-provider-azure/pull/3115#" title="Author self-approved">cvvz</a>*
**Once this PR has been reviewed and has the lgtm label**, please assign jwtty for approval by writing `/assign @jwtty` in a comment. For more information see [the Kubernetes Code Review Process](https://git.k8s.io/community/contributors/guide/owners.md#the-code-review-process).

The full list of commands accepted by this bot can be found [here](https://go.k8s.io/bot-commands?repo=kubernetes-sigs%2Fcloud-provider-azure).

<details open>
Needs approval from an approver in each of these files:

- **[OWNERS](https://github.com/kubernetes-sigs/cloud-provider-azure/blob/master/OWNERS)**

Approvers can indicate their approval by writing `/approve` in a comment
Approvers can cancel approval by writing `/approve cancel` in a comment
</details>
<!-- META={"approvers":["jwtty"]} -->
k8s-ci-robot: Hi @cvvz. Thanks for your PR.

I'm waiting for a [kubernetes-sigs](https://github.com/orgs/kubernetes-sigs/people) member to verify that this patch is reasonable to test. If it is, they should reply with `/ok-to-test` on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work. Regular contributors should [join the org](https://git.k8s.io/community/community-membership.md#member) to skip this step.

Once the patch is verified, the new status will be reflected by the `ok-to-test` label.

I understand the commands that are listed [here](https://go.k8s.io/bot-commands?repo=kubernetes-sigs%2Fcloud-provider-azure).

<details>

Instructions for interacting with me using PR comments are available [here](https://git.k8s.io/community/contributors/guide/pull-requests.md).  If you have questions or suggestions related to my behavior, please file an issue against the [kubernetes/test-infra](https://github.com/kubernetes/test-infra/issues/new?title=Prow%20issue:) repository.
</details>

netlify[bot]: ### <span aria-hidden="true">👷</span> Deploy Preview for *kubernetes-sigs-cloud-provide-azure* processing.


|  Name | Link |
|---------------------------------|------------------------|
|<span aria-hidden="true">🔨</span> Latest commit | e0a6674b2910d095d02b792d885a7791b3f37738 |
|<span aria-hidden="true">🔍</span> Latest deploy log | https://app.netlify.com/sites/kubernetes-sigs-cloud-provide-azure/deploys/63c0cbb5ebc6c50008d544b5 |
cvvz: @andyzhangx PTAL
k8s-ci-robot: @cvvz: Adding label `do-not-merge/contains-merge-commits` because PR contains merge commits, which are not allowed in this repository.
Use `git rebase` to reapply your commits on top of the target branch. Detailed instructions for doing so can be found [here](https://git.k8s.io/community/contributors/guide/github-workflow.md#4-keep-your-branch-in-sync).

<details>

Instructions for interacting with me using PR comments are available [here](https://git.k8s.io/community/contributors/guide/pull-requests.md).  If you have questions or suggestions related to my behavior, please file an issue against the [kubernetes/test-infra](https://github.com/kubernetes/test-infra/issues/new?title=Prow%20issue:) repository.
</details>
andyzhangx: > @cvvz: Adding label `do-not-merge/contains-merge-commits` because PR contains merge commits, which are not allowed in this repository. Use `git rebase` to reapply your commits on top of the target branch. Detailed instructions for doing so can be found [here](https://git.k8s.io/community/contributors/guide/github-workflow.md#4-keep-your-branch-in-sync).

@cvvz you could use `git rebase upstream/master` to rebase to master branch, then you won't have this warning message.
k8s-ci-robot: @cvvz: The following test **failed**, say `/retest` to rerun all failed tests or `/retest-required` to rerun all mandatory failed tests:

Test name | Commit | Details | Required | Rerun command
--- | --- | --- | --- | ---
pull-cloud-provider-azure-unit | 54bd7e601cce3d9fcd2fa1ed0372b8019f8aa15b | [link](https://prow.k8s.io/view/gs/kubernetes-jenkins/pr-logs/pull/kubernetes-sigs_cloud-provider-azure/3115/pull-cloud-provider-azure-unit/1615272776271138816) | true | `/test pull-cloud-provider-azure-unit`

[Full PR test history](https://prow.k8s.io/pr-history?org=kubernetes-sigs&repo=cloud-provider-azure&pr=3115). [Your PR dashboard](https://prow.k8s.io/pr?query=is%3Apr%20state%3Aopen%20author%3Acvvz). Please help us cut down on flakes by [linking to](https://git.k8s.io/community/contributors/devel/sig-testing/flaky-tests.md#filing-issues-for-flaky-tests) an [open issue](https://github.com/kubernetes-sigs/cloud-provider-azure/issues?q=is:issue+is:open) when you hit one in your PR.

<details>

Instructions for interacting with me using PR comments are available [here](https://git.k8s.io/community/contributors/guide/pull-requests.md).  If you have questions or suggestions related to my behavior, please file an issue against the [kubernetes/test-infra](https://github.com/kubernetes/test-infra/issues/new?title=Prow%20issue:) repository. I understand the commands that are listed [here](https://go.k8s.io/bot-commands).
</details>
<!-- test report -->
k8s-ci-robot: @cvvz: Adding label `do-not-merge/contains-merge-commits` because PR contains merge commits, which are not allowed in this repository.
Use `git rebase` to reapply your commits on top of the target branch. Detailed instructions for doing so can be found [here](https://git.k8s.io/community/contributors/guide/github-workflow.md#4-keep-your-branch-in-sync).

<details>

Instructions for interacting with me using PR comments are available [here](https://git.k8s.io/community/contributors/guide/pull-requests.md).  If you have questions or suggestions related to my behavior, please file an issue against the [kubernetes/test-infra](https://github.com/kubernetes/test-infra/issues/new?title=Prow%20issue:) repository.
</details>

Patch:
diff --git a/pkg/azureclients/blobclient/azure_blobclient.go b/pkg/azureclients/blobclient/azure_blobclient.go
index 517f8bda7..d1fb1d080 100644
--- a/pkg/azureclients/blobclient/azure_blobclient.go
+++ b/pkg/azureclients/blobclient/azure_blobclient.go
@@ -38,9 +38,12 @@ var _ Interface = &Client{}
 
 // Client implements the blobclient interface
 type Client struct {
-	armClient      armclient.Interface
-	subscriptionID string
-	cloudName      string
+	blobServicesClient storage.BlobServicesClient
+	armClient          armclient.Interface
+	subscriptionID     string
+	cloudName          string
+	baseURI            string
+	authorizer         autorest.Authorizer
 
 	// Rate limiting configures.
 	rateLimiterReader flowcontrol.RateLimiter
@@ -60,6 +63,9 @@ func New(config *azclients.ClientConfig) *Client {
 	authorizer := config.Authorizer
 	apiVersion := APIVersion
 
+	blobServicesClient := storage.NewBlobServicesClientWithBaseURI(baseURI, config.SubscriptionID)
+	blobServicesClient.Authorizer = authorizer
+
 	if strings.EqualFold(config.CloudName, AzureStackCloudName) && !config.DisableAzureStackCloud {
 		apiVersion = AzureStackCloudAPIVersion
 	}
@@ -78,12 +84,15 @@ func New(config *azclients.ClientConfig) *Client {
 	}
 
 	client := &Client{
-		armClient:         armClient,
-		rateLimiterReader: rateLimiterReader,
-		rateLimiterWriter: rateLimiterWriter,
-		subscriptionID:    config.SubscriptionID,
-		cloudName:         config.CloudName,
-		now:               time.Now,
+		blobServicesClient: blobServicesClient,
+		armClient:          armClient,
+		rateLimiterReader:  rateLimiterReader,
+		rateLimiterWriter:  rateLimiterWriter,
+		subscriptionID:     config.SubscriptionID,
+		cloudName:          config.CloudName,
+		now:                time.Now,
+		baseURI:            baseURI,
+		authorizer:         authorizer,
 	}
 
 	return client
@@ -268,3 +277,21 @@ func (c *Client) getContainer(ctx context.Context, subsID, resourceGroupName, ac
 	container.Response = autorest.Response{Response: response}
 	return container, nil
 }
+
+func (c *Client) GetServiceProperties(ctx context.Context, subsID, resourceGroupName, accountName string) (storage.BlobServiceProperties, error) {
+	blobServicesClient := c.blobServicesClient
+	if subsID != c.subscriptionID {
+		blobServicesClient = storage.NewBlobServicesClientWithBaseURI(c.baseURI, c.subscriptionID)
+		blobServicesClient.Authorizer = c.authorizer
+	}
+	return blobServicesClient.GetServiceProperties(ctx, resourceGroupName, accountName)
+}
+
+func (c *Client) SetServiceProperties(ctx context.Context, subsID, resourceGroupName, accountName string, parameters storage.BlobServiceProperties) (storage.BlobServiceProperties, error) {
+	blobServicesClient := c.blobServicesClient
+	if subsID != c.subscriptionID {
+		blobServicesClient = storage.NewBlobServicesClientWithBaseURI(c.baseURI, c.subscriptionID)
+		blobServicesClient.Authorizer = c.authorizer
+	}
+	return blobServicesClient.SetServiceProperties(ctx, resourceGroupName, accountName, parameters)
+}
diff --git a/pkg/azureclients/blobclient/interface.go b/pkg/azureclients/blobclient/interface.go
index b8ac9d8d7..3f89e3f1c 100644
--- a/pkg/azureclients/blobclient/interface.go
+++ b/pkg/azureclients/blobclient/interface.go
@@ -39,4 +39,6 @@ type Interface interface {
 	CreateContainer(ctx context.Context, subsID, resourceGroupName, accountName, containerName string, parameters storage.BlobContainer) *retry.Error
 	DeleteContainer(ctx context.Context, subsID, resourceGroupName, accountName, containerName string) *retry.Error
 	GetContainer(ctx context.Context, subsID, resourceGroupName, accountName, containerName string) (storage.BlobContainer, *retry.Error)
+	GetServiceProperties(ctx context.Context, subsID, resourceGroupName, accountName string) (storage.BlobServiceProperties, error)
+	SetServiceProperties(ctx context.Context, subsID, resourceGroupName, accountName string, parameters storage.BlobServiceProperties) (storage.BlobServiceProperties, error)
 }
diff --git a/pkg/azureclients/blobclient/mockblobclient/interface.go b/pkg/azureclients/blobclient/mockblobclient/interface.go
index 115c20523..80324d6c6 100644
--- a/pkg/azureclients/blobclient/mockblobclient/interface.go
+++ b/pkg/azureclients/blobclient/mockblobclient/interface.go
@@ -95,3 +95,33 @@ func (mr *MockInterfaceMockRecorder) GetContainer(ctx, subsID, resourceGroupName
 	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetContainer", reflect.TypeOf((*MockInterface)(nil).GetContainer), ctx, subsID, resourceGroupName, accountName, containerName)
 }
+
+// GetServiceProperties mocks base method.
+func (m *MockInterface) GetServiceProperties(ctx context.Context, subsID, resourceGroupName, accountName string) (storage.BlobServiceProperties, error) {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "GetServiceProperties", ctx, subsID, resourceGroupName, accountName)
+	ret0, _ := ret[0].(storage.BlobServiceProperties)
+	ret1, _ := ret[1].(error)
+	return ret0, ret1
+}
+
+// GetServiceProperties indicates an expected call of GetServiceProperties.
+func (mr *MockInterfaceMockRecorder) GetServiceProperties(ctx, subsID, resourceGroupName, accountName interface{}) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetServiceProperties", reflect.TypeOf((*MockInterface)(nil).GetServiceProperties), ctx, subsID, resourceGroupName, accountName)
+}
+
+// SetServiceProperties mocks base method.
+func (m *MockInterface) SetServiceProperties(ctx context.Context, subsID, resourceGroupName, accountName string, parameters storage.BlobServiceProperties) (storage.BlobServiceProperties, error) {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "SetServiceProperties", ctx, subsID, resourceGroupName, accountName, parameters)
+	ret0, _ := ret[0].(storage.BlobServiceProperties)
+	ret1, _ := ret[1].(error)
+	return ret0, ret1
+}
+
+// SetServiceProperties indicates an expected call of SetServiceProperties.
+func (mr *MockInterfaceMockRecorder) SetServiceProperties(ctx, subsID, resourceGroupName, accountName, parameters interface{}) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "SetServiceProperties", reflect.TypeOf((*MockInterface)(nil).SetServiceProperties), ctx, subsID, resourceGroupName, accountName, parameters)
+}
diff --git a/pkg/provider/azure_storageaccount.go b/pkg/provider/azure_storageaccount.go
index 9493c10e8..c27f7f518 100644
--- a/pkg/provider/azure_storageaccount.go
+++ b/pkg/provider/azure_storageaccount.go
@@ -72,6 +72,9 @@ type AccountOptions struct {
 	SubnetName                              string
 	AccessTier                              string
 	MatchTags                               bool
+	EnableBlobVersioning                    *bool
+	SoftDeleteBlobs                         int32
+	SoftDeleteContainers                    int32
 }
 
 type accountWithLocation struct {
@@ -106,9 +109,11 @@ func (az *Cloud) getStorageAccounts(ctx context.Context, accountOptions *Account
 				isAccessTierEqual(acct, accountOptions) &&
 				az.isMultichannelEnabledEqual(ctx, acct, accountOptions) &&
 				az.isDisableFileServiceDeleteRetentionPolicyEqual(ctx, acct, accountOptions) &&
+				az.isEnableBlobDataProtectionEqual(ctx, acct, accountOptions) &&
 				isPrivateEndpointAsExpected(acct, accountOptions)) {
 				continue
 			}
+
 			accounts = append(accounts, accountWithLocation{Name: *acct.Name, StorageType: string((*acct.Sku).Name), Location: *acct.Location})
 		}
 	}
@@ -355,6 +360,42 @@ func (az *Cloud) EnsureStorageAccount(ctx context.Context, accountOptions *Accou
 			return "", "", fmt.Errorf("failed to create storage account %s, error: %v", accountName, rerr)
 		}
 
+		if pointer.BoolDeref(accountOptions.EnableBlobVersioning, false) ||
+			accountOptions.SoftDeleteBlobs > 0 ||
+			accountOptions.SoftDeleteContainers > 0 {
+			var blobPolicy, containerPolicy *storage.DeleteRetentionPolicy
+			var enableBlobVersioning *bool
+
+			if accountOptions.SoftDeleteContainers > 0 {
+				containerPolicy = &storage.DeleteRetentionPolicy{
+					Enabled: pointer.Bool(accountOptions.SoftDeleteContainers > 0),
+					Days:    pointer.Int32(accountOptions.SoftDeleteContainers),
+				}
+			}
+			if accountOptions.SoftDeleteBlobs > 0 {
+				blobPolicy = &storage.DeleteRetentionPolicy{
+					Enabled: pointer.Bool(accountOptions.SoftDeleteBlobs > 0),
+					Days:    pointer.Int32(accountOptions.SoftDeleteBlobs),
+				}
+			}
+
+			if accountOptions.EnableBlobVersioning != nil {
+				enableBlobVersioning = pointer.Bool(*accountOptions.EnableBlobVersioning)
+			}
+
+			property := storage.BlobServiceProperties{
+				BlobServicePropertiesProperties: &storage.BlobServicePropertiesProperties{
+					IsVersioningEnabled:            enableBlobVersioning,
+					ContainerDeleteRetentionPolicy: containerPolicy,
+					DeleteRetentionPolicy:          blobPolicy,
+				},
+			}
+
+			if _, err := az.BlobClient.SetServiceProperties(ctx, subsID, resourceGroup, accountName, property); err != nil {
+				return "", "", fmt.Errorf("failed to set blob service properties for storage account %s, error: %w", accountName, err)
+			}
+		}
+
 		if accountOptions.DisableFileServiceDeleteRetentionPolicy != nil || accountOptions.IsMultichannelEnabled != nil {
 			prop, err := az.FileClient.WithSubscriptionID(subsID).GetServiceProperties(ctx, resourceGroup, accountName)
 			if err != nil {
@@ -733,3 +774,53 @@ func (az *Cloud) isDisableFileServiceDeleteRetentionPolicyEqual(ctx context.Cont
 
 	return *accountOptions.DisableFileServiceDeleteRetentionPolicy != *prop.FileServicePropertiesProperties.ShareDeleteRetentionPolicy.Enabled
 }
+
+func (az *Cloud) isEnableBlobDataProtectionEqual(ctx context.Context, account storage.Account, accountOptions *AccountOptions) bool {
+	if accountOptions.SoftDeleteBlobs == 0 &&
+		accountOptions.SoftDeleteContainers == 0 &&
+		accountOptions.EnableBlobVersioning == nil {
+		return true
+	}
+
+	property, err := az.BlobClient.GetServiceProperties(ctx, accountOptions.SubscriptionID, accountOptions.ResourceGroup, *account.Name)
+	if err != nil {
+		klog.Warningf("GetServiceProperties failed for account %s, err: %v", *account.Name, err)
+		return false
+	}
+
+	return isSoftDeleteBlobsEqual(property, accountOptions) &&
+		isSoftDeleteContainersEqual(property, accountOptions) &&
+		isEnableBlobVersioningEqual(property, accountOptions)
+}
+
+func isSoftDeleteBlobsEqual(property storage.BlobServiceProperties, accountOptions *AccountOptions) bool {
+	wantEnable := accountOptions.SoftDeleteBlobs > 0
+	actualEnable := property.DeleteRetentionPolicy != nil &&
+		pointer.BoolDeref(property.DeleteRetentionPolicy.Enabled, false)
+	if wantEnable != actualEnable {
+		return false
+	}
+	if !actualEnable {
+		return true
+	}
+
+	return accountOptions.SoftDeleteBlobs == pointer.Int32Deref(property.DeleteRetentionPolicy.Days, 0)
+}
+
+func isSoftDeleteContainersEqual(property storage.BlobServiceProperties, accountOptions *AccountOptions) bool {
+	wantEnable := accountOptions.SoftDeleteContainers > 0
+	actualEnable := property.ContainerDeleteRetentionPolicy != nil &&
+		pointer.BoolDeref(property.ContainerDeleteRetentionPolicy.Enabled, false)
+	if wantEnable != actualEnable {
+		return false
+	}
+	if !actualEnable {
+		return true
+	}
+
+	return accountOptions.SoftDeleteContainers == pointer.Int32Deref(property.ContainerDeleteRetentionPolicy.Days, 0)
+}
+
+func isEnableBlobVersioningEqual(property storage.BlobServiceProperties, accountOptions *AccountOptions) bool {
+	return pointer.BoolDeref(accountOptions.EnableBlobVersioning, false) == pointer.BoolDeref(property.IsVersioningEnabled, false)
+}


Test patch:
diff --git a/pkg/provider/azure_storage_test.go b/pkg/provider/azure_storage_test.go
index 40130e146..3e957969c 100644
--- a/pkg/provider/azure_storage_test.go
+++ b/pkg/provider/azure_storage_test.go
@@ -24,6 +24,7 @@ import (
 	"github.com/Azure/go-autorest/autorest/azure"
 	"github.com/golang/mock/gomock"
 
+	"sigs.k8s.io/cloud-provider-azure/pkg/azureclients/blobclient/mockblobclient"
 	"sigs.k8s.io/cloud-provider-azure/pkg/azureclients/fileclient"
 	"sigs.k8s.io/cloud-provider-azure/pkg/azureclients/fileclient/mockfileclient"
 	"sigs.k8s.io/cloud-provider-azure/pkg/azureclients/storageaccountclient/mockstorageaccountclient"
@@ -168,6 +169,12 @@ func TestCreateFileShare(t *testing.T) {
 		mockStorageAccountsClient.EXPECT().ListByResourceGroup(gomock.Any(), gomock.Any(), "rg").Return(test.accounts, nil).AnyTimes()
 		mockStorageAccountsClient.EXPECT().Create(gomock.Any(), "", "rg", gomock.Any(), gomock.Any()).Return(nil).AnyTimes()
 
+		mockBlobClient := mockblobclient.NewMockInterface(ctrl)
+		cloud.BlobClient = mockBlobClient
+		mockBlobClient.EXPECT().GetServiceProperties(gomock.Any(), gomock.Any(), gomock.Any(), gomock.Any()).Return(storage.BlobServiceProperties{
+			BlobServicePropertiesProperties: &storage.BlobServicePropertiesProperties{}}, nil).AnyTimes()
+		mockBlobClient.EXPECT().SetServiceProperties(gomock.Any(), gomock.Any(), gomock.Any(), gomock.Any(), gomock.Any()).Return(storage.BlobServiceProperties{}, nil).AnyTimes()
+
 		mockAccount := &AccountOptions{
 			Name:          test.acct,
 			Type:          test.acctType,
diff --git a/pkg/provider/azure_storageaccount_test.go b/pkg/provider/azure_storageaccount_test.go
index 2781a31b0..b3bb886c7 100644
--- a/pkg/provider/azure_storageaccount_test.go
+++ b/pkg/provider/azure_storageaccount_test.go
@@ -29,6 +29,7 @@ import (
 	"github.com/stretchr/testify/assert"
 	"k8s.io/utils/pointer"
 
+	"sigs.k8s.io/cloud-provider-azure/pkg/azureclients/blobclient/mockblobclient"
 	"sigs.k8s.io/cloud-provider-azure/pkg/azureclients/fileclient/mockfileclient"
 	"sigs.k8s.io/cloud-provider-azure/pkg/azureclients/privatednsclient/mockprivatednsclient"
 	"sigs.k8s.io/cloud-provider-azure/pkg/azureclients/privatednszonegroupclient/mockprivatednszonegroupclient"
@@ -447,6 +448,12 @@ func TestEnsureStorageAccount(t *testing.T) {
 	}
 
 	for _, test := range tests {
+		mockBlobClient := mockblobclient.NewMockInterface(ctrl)
+		cloud.BlobClient = mockBlobClient
+		mockBlobClient.EXPECT().GetServiceProperties(gomock.Any(), gomock.Any(), gomock.Any(), gomock.Any()).Return(storage.BlobServiceProperties{
+			BlobServicePropertiesProperties: &storage.BlobServicePropertiesProperties{}}, nil).AnyTimes()
+		mockBlobClient.EXPECT().SetServiceProperties(gomock.Any(), gomock.Any(), gomock.Any(), gomock.Any(), gomock.Any()).Return(storage.BlobServiceProperties{}, nil).AnyTimes()
+
 		mockStorageAccountsClient := mockstorageaccountclient.NewMockInterface(ctrl)
 		if test.mockStorageAccountsClient {
 			cloud.StorageAccountClient = mockStorageAccountsClient
@@ -502,6 +509,9 @@ func TestEnsureStorageAccount(t *testing.T) {
 				SubscriptionID:        test.subscriptionID,
 				AccessTier:            test.accessTier,
 				StorageType:           test.storageType,
+				EnableBlobVersioning:  pointer.BoolPtr(true),
+				SoftDeleteBlobs:       7,
+				SoftDeleteContainers:  7,
 			}
 		}
 
@@ -1431,3 +1441,208 @@ func TestIsDisableFileServiceDeleteRetentionPolicyEqual(t *testing.T) {
 		assert.Equal(t, test.expectedResult, result, test.desc)
 	}
 }
+
+func Test_isSoftDeleteBlobsEqual(t *testing.T) {
+	type args struct {
+		property       storage.BlobServiceProperties
+		accountOptions *AccountOptions
+	}
+	tests := []struct {
+		name string
+		args args
+		want bool
+	}{
+		{
+			name: "not equal for property nil",
+			args: args{
+				property: storage.BlobServiceProperties{
+					BlobServicePropertiesProperties: &storage.BlobServicePropertiesProperties{},
+				},
+				accountOptions: &AccountOptions{
+					SoftDeleteBlobs: 7,
+				},
+			},
+			want: false,
+		},
+		{
+			name: "not equal for property not enable",
+			args: args{
+				property: storage.BlobServiceProperties{
+					BlobServicePropertiesProperties: &storage.BlobServicePropertiesProperties{
+						DeleteRetentionPolicy: &storage.DeleteRetentionPolicy{
+							Enabled: pointer.Bool(false),
+						},
+					},
+				},
+				accountOptions: &AccountOptions{
+					SoftDeleteBlobs: 7,
+				},
+			},
+			want: false,
+		},
+		{
+			name: "not equal for accountOptions nil",
+			args: args{
+				property: storage.BlobServiceProperties{
+					BlobServicePropertiesProperties: &storage.BlobServicePropertiesProperties{
+						DeleteRetentionPolicy: &storage.DeleteRetentionPolicy{
+							Enabled: pointer.Bool(true),
+							Days:    pointer.Int32(7),
+						},
+					},
+				},
+				accountOptions: &AccountOptions{},
+			},
+			want: false,
+		},
+		{
+			name: "qual",
+			args: args{
+				property: storage.BlobServiceProperties{
+					BlobServicePropertiesProperties: &storage.BlobServicePropertiesProperties{
+						DeleteRetentionPolicy: &storage.DeleteRetentionPolicy{
+							Enabled: pointer.Bool(true),
+							Days:    pointer.Int32(7),
+						},
+					},
+				},
+				accountOptions: &AccountOptions{
+					SoftDeleteBlobs: 7,
+				},
+			},
+			want: true,
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			if got := isSoftDeleteBlobsEqual(tt.args.property, tt.args.accountOptions); got != tt.want {
+				t.Errorf("isSoftDeleteBlobsEqual() = %v, want %v", got, tt.want)
+			}
+		})
+	}
+}
+
+func Test_isSoftDeleteContainersEqual(t *testing.T) {
+	type args struct {
+		property       storage.BlobServiceProperties
+		accountOptions *AccountOptions
+	}
+	tests := []struct {
+		name string
+		args args
+		want bool
+	}{
+		{
+			name: "not equal for property nil",
+			args: args{
+				property: storage.BlobServiceProperties{
+					BlobServicePropertiesProperties: &storage.BlobServicePropertiesProperties{},
+				},
+				accountOptions: &AccountOptions{
+					SoftDeleteContainers: 7,
+				},
+			},
+			want: false,
+		},
+		{
+			name: "not equal for property not enable",
+			args: args{
+				property: storage.BlobServiceProperties{
+					BlobServicePropertiesProperties: &storage.BlobServicePropertiesProperties{
+						ContainerDeleteRetentionPolicy: &storage.DeleteRetentionPolicy{
+							Enabled: pointer.Bool(false),
+						},
+					},
+				},
+				accountOptions: &AccountOptions{
+					SoftDeleteContainers: 7,
+				},
+			},
+			want: false,
+		},
+		{
+			name: "not equal for accountOptions nil",
+			args: args{
+				property: storage.BlobServiceProperties{
+					BlobServicePropertiesProperties: &storage.BlobServicePropertiesProperties{
+						ContainerDeleteRetentionPolicy: &storage.DeleteRetentionPolicy{
+							Enabled: pointer.Bool(true),
+							Days:    pointer.Int32(7),
+						},
+					},
+				},
+				accountOptions: &AccountOptions{},
+			},
+			want: false,
+		},
+		{
+			name: "qual",
+			args: args{
+				property: storage.BlobServiceProperties{
+					BlobServicePropertiesProperties: &storage.BlobServicePropertiesProperties{
+						ContainerDeleteRetentionPolicy: &storage.DeleteRetentionPolicy{
+							Enabled: pointer.Bool(true),
+							Days:    pointer.Int32(7),
+						},
+					},
+				},
+				accountOptions: &AccountOptions{
+					SoftDeleteContainers: 7,
+				},
+			},
+			want: true,
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			if got := isSoftDeleteContainersEqual(tt.args.property, tt.args.accountOptions); got != tt.want {
+				t.Errorf("isSoftDeleteContainersEqual() = %v, want %v", got, tt.want)
+			}
+		})
+	}
+}
+
+func Test_isEnableBlobVersioningEqual(t *testing.T) {
+	type args struct {
+		property       storage.BlobServiceProperties
+		accountOptions *AccountOptions
+	}
+	tests := []struct {
+		name string
+		args args
+		want bool
+	}{
+		{
+			name: "equal",
+			args: args{
+				property: storage.BlobServiceProperties{
+					BlobServicePropertiesProperties: &storage.BlobServicePropertiesProperties{},
+				},
+				accountOptions: &AccountOptions{
+					EnableBlobVersioning: pointer.Bool(false),
+				},
+			},
+			want: true,
+		},
+		{
+			name: "not equal",
+			args: args{
+				property: storage.BlobServiceProperties{
+					BlobServicePropertiesProperties: &storage.BlobServicePropertiesProperties{
+						IsVersioningEnabled: pointer.Bool(true),
+					},
+				},
+				accountOptions: &AccountOptions{
+					EnableBlobVersioning: pointer.Bool(false),
+				},
+			},
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			if got := isEnableBlobVersioningEqual(tt.args.property, tt.args.accountOptions); got != tt.want {
+				t.Errorf("isEnableBlobVersioningEqual() = %v, want %v", got, tt.want)
+			}
+		})
+	}
+}