Repository navigation
objectstore-plugin: Azure Blob Storage backend #3381
Description
We run Substrate on AKS and want to keep snapshots and assets in Azure Blob Storage. Today the in-tree plugin supports GCS and S3 (ATE_STORAGE_BACKEND). Our options are:
- An out-of-tree plugin, as discussed in objectstore plugin: what an out-of-tree provider needs, with and without per-actor credentials #3095 . It works with the public objectstore.v1 API and pkg/objectstorage, but a third-party ObjectStorage can't use the sparse, streaming or multipart upload paths (they sit behind unexported interfaces), and the control-plane copy and delete logic in internal/objectstore can't be reused.
- A third in-tree backend, ATE_STORAGE_BACKEND=azure, next to GCS and S3.
We'd like to contribute the third option, using Azure Workload Identity for credentials and native server-side copy for CopySnapshot. It would follow the S3 backend's model (pod credentials, actor_jwt ignored) and leave per-actor scoping for later, once actorauthz from #3095 lands.
Would you accept an in-tree Azure backend, or would you rather keep non-GCS/S3 providers out of tree? If out of tree, would you consider exporting the fast upload paths for third-party clients?
If in-tree is fine, I'd split it into small PRs: the pkg/objectstorage Azure client, then the internal/objectstore Store, then the manifests and docs.
Related: #3095
Activity
ridhoq commentedon Oct 28, 2026
You can follow this #2595 PR. The current path is to have a separate, out of tree objectstore plugin for azure-blob cc Anish Ramasekar (@aramase)
BenTheElder commentedon Oct 29, 2026
The work to enable the out of tree plugin is in flight. It will be there for GA, the entire plugin model is to solve this problem versus aiming for S3 compat everywhere, basically. We don't mind having azure, what we do mind is having N++ cloud provider SDKs compiled in over time, Kubernetes had a long saga with this and we're getting ahead of it, so to enable 3+ we're doing out of tree plugins in independent repos. There were some other things in the way here, basically it is easier for us to create repos under the CNCF now that we've secured the donation, mid-donation creating new repos was problematic.
While the necessary pre-req PRs are in flight, I've spun up the plugins org and honed the GCP secrets plugin there to prove out setting that up.
BenTheElder commentedon Oct 30, 2026
[We're adding azure blob support, via a dedicated plugin, #2595 will be updated with pointers]