feat: add support for DefaultAzureCredential authentication mechanism #681
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This commit adds support for the DefaultAzureCredential authentication mechanism in Azure Blob Storage. Users can now use the `useDefaultAzureCredentials` option to enable Azure's default credential chain, which automatically discovers and uses available credentials in the following order Signed-off-by: Armando Ruocco <armando.ruocco@enterprisedb.com>
dosubot
bot
added
size:L
armru
changed the title
GabriFedi97
reviewed
Dec 22, 2025
Comment on lines
+40
to
+41
| // When using default Azure credentials, no secrets are required | ||
| if !barmanCredentials.Azure.UseDefaultAzureCredentials { |
Contributor
There was a problem hiding this comment.
Should we include also barmanCredentials.Azure.InheritFromAzureAD here?
Suggested change
| // When using default Azure credentials, no secrets are required | |
| if !barmanCredentials.Azure.UseDefaultAzureCredentials { | |
| // When using default Azure credentials or AzureAD, no secrets are required | |
| if !barmanCredentials.Azure.UseDefaultAzureCredentials && !barmanCredentials.Azure.InheritFromAzureAD { |
Comment on lines
+266
to
+267
| This is particularly useful when running on Azure Kubernetes Service (AKS) with | ||
| [Workload Identity](https://learn.microsoft.com/en-us/azure/aks/workload-identity-overview): |
Contributor
There was a problem hiding this comment.
I'm not sure if this assessment is totally precise. I think Azure Default Credentials are primarily useful to delegate to the SDK the auth mechanism inferring it from the environment, so that different auth methods can be used in different environments seamlessly.
Contributor
|
@armru the manifests generation seems to be missing in this PR |
Signed-off-by: Armando Ruocco <armando.ruocco@enterprisedb.com>
Signed-off-by: Armando Ruocco <armando.ruocco@enterprisedb.com>
GabriFedi97
added a commit
to GabriFedi97/plugin-barman-cloud
that referenced
this pull request
Dec 23, 2025
…g#681) Make explicit in docs that the inheritFromAzureAD option enables the usage of Azure Managed Identity authentication mechanism. Signed-off-by: Gabriele Fedi <gabriele.fedi@enterprisedb.com>
GabriFedi97
added a commit
to GabriFedi97/plugin-barman-cloud
that referenced
this pull request
Dec 23, 2025
…g#681) Make explicit in docs that the inheritFromAzureAD option enables the usage of Azure Managed Identity authentication mechanism. Signed-off-by: Gabriele Fedi <gabriele.fedi@enterprisedb.com>
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This commit adds support for the DefaultAzureCredential authentication mechanism in Azure Blob Storage. Users can now use the
useDefaultAzureCredentialsoption to enable Azure's default credential chain, which automatically discovers and uses available credentials in the following orderThis is particularly useful when running on Azure Kubernetes Service (AKS) with
Workload Identity, eliminating the need to explicitly store credentials in
Kubernetes Secrets.