Azure Blob Storage

FlexFS supports Azure Blob Storage as a block store backend using the Azure SDK for Go. Authentication is handled via shared key credentials (storage account access key) or Azure Default Credentials (managed identity, environment variables, etc.).

Storage account

Create a storage account or use an existing one. FlexFS uses the Blob Storage service.

# Create a resource group (if needed)
az group create --name flexfs-rg --location eastus

# Create a storage account
az storage account create \
  --name myflexfsblocks \
  --resource-group flexfs-rg \
  --location eastus \
  --sku Standard_LRS \
  --kind StorageV2

Recommended settings

Performance tier: Standard is sufficient for most workloads. Premium can be used for latency-sensitive deployments.
Redundancy: LRS (Locally Redundant Storage) is the minimum. Choose based on your durability requirements.
Public access: Disable blob public access. FlexFS authenticates all requests.
Hierarchical namespace (Data Lake): Not required. FlexFS uses flat blob storage.

Container creation

Create a container within the storage account to hold flexFS blocks:

az storage container create \
  --name flexfs-blocks \
  --account-name myflexfsblocks

Authentication

Shared key credentials

The simplest authentication method uses the storage account name and access key:

# Retrieve the access key
az storage account keys list \
  --account-name myflexfsblocks \
  --resource-group flexfs-rg \
  --query '[0].value' -o tsv

When configuring the flexFS block store credentials:

blockUser: The storage account name (e.g. myflexfsblocks)
blockPass: The storage account access key

When no address is configured, flexFS constructs the blob service URL automatically from the storage account name:

https://<blockUser>.blob.core.windows.net/

Setting an address replaces that URL outright; see the block store configuration below.

Azure Default Credentials (managed identity)

When blockPass is empty but blockUser is provided, flexFS uses the Azure Default Credentials chain. This supports:

Managed Identity: On Azure VMs and Azure Kubernetes Service (AKS), a system-assigned or user-assigned managed identity can authenticate automatically.
Environment variables: AZURE_CLIENT_ID, AZURE_TENANT_ID, and AZURE_CLIENT_SECRET for service principal authentication.
Azure CLI credentials: For local development via az login.

To use managed identity on an Azure VM:

# Assign a system-managed identity to the VM
az vm identity assign \
  --name my-vm \
  --resource-group flexfs-rg

# Grant Storage Blob Data Contributor role
az role assignment create \
  --assignee <principal-id> \
  --role "Storage Blob Data Contributor" \
  --scope "/subscriptions/<sub-id>/resourceGroups/flexfs-rg/providers/Microsoft.Storage/storageAccounts/myflexfsblocks"

Managed identity is the recommended authentication method for production deployments on Azure.

SAS tokens

Azure Shared Access Signatures (SAS) are not supported. A SAS URL cannot be supplied as the address: every Azure client flexFS builds is constructed with a credential, and an address carrying a query string is rejected. Use shared key or managed identity as described above.

Block store configuration

When creating a block store via configure.flexfs (Enterprise) or the installer, provide:

Field	Value
Provider	`azure`
Region	Azure region (e.g. `eastus`)
API	`azure`
Bucket	Your container name (e.g. `flexfs-blocks`)
Prefix	Optional key prefix
Address	Leave empty for the public cloud (constructed as `<account>.blob.core.windows.net`); set `--address` to the full service endpoint for a sovereign cloud, Azure Stack, a custom domain, or the Azurite emulator (`http://127.0.0.1:10000/devstoreaccount1`)
blockUser	Storage account name (always required)
blockPass	Storage account access key (or leave empty for managed identity)