docs: expand Azure Workload Identity for blob storage - #16331
Open
locker95 wants to merge 2 commits into
Open
Conversation
Document account_key-less auth, user_assigned_id, fix broken Helm annotation YAML, and sketch AKS federated identity setup. Signed-off-by: Dean Chen <862469039@qq.com>
locker95
force-pushed
the
docs/azure-workload-identity-expand
branch
from
August 9, 2026 12:45
536a78c to
d4c2ab6
Compare
JStickler
reviewed
Aug 10, 2026
| Here is an example configuration for using Azure Workload Identity. | ||
| When `account_key` and `connection_string` are **unset**, Mimir authenticates | ||
| to Azure Blob Storage with Azure AD / managed identity (including Azure | ||
| Workload Identity on Kubernetes). Optional fields: |
Contributor
There was a problem hiding this comment.
You're saying "optional fields" on line 154 and then line 158 contradicts this noting that account_name is "required." I would remove the "Optional fields:" to avoid confusion.
| account_name: mimirprod | ||
| endpoint_suffix: "blob.core.windows.net" | ||
| endpoint_suffix: blob.core.windows.net | ||
| # account_key intentionally omitted — use managed / workload identity |
Contributor
There was a problem hiding this comment.
Suggested change
| # account_key intentionally omitted — use managed / workload identity | |
| # account_key: leave unset to use managed / workload identity |
| {{< admonition type="note" >}} | ||
| Unlike with Tempo, federated tokens are not supported with Mimir. | ||
| Unlike with Tempo, federated tokens are not supported with Mimir beyond this | ||
| managed / workload identity path. Do not set `account_key` if you want identity-based auth. |
Contributor
There was a problem hiding this comment.
Suggested change
| managed / workload identity path. Do not set `account_key` if you want identity-based auth. | |
| managed / workload identity path. Do not set `account_key` if you want identity-based authentication. |
Drop the confusing Optional fields label, and apply docs-team phrasing for the account_key notes. Signed-off-by: Dean Chen <862469039@qq.com>
Contributor
Author
|
dropped the Optional fields label and took your wording on the account_key notes. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The object-storage backend page already had a Workload Identity example, but the Helm annotations were invalid YAML and it didn't explain
account_keyomission oruser_assigned_id. Expanded that section with field notes and a short AKS setup sketch.Fixes #14742