How to use DefaultAzureCredential in plugin for backup on azure blob storage

[beingvishalt]

Hi @dosu, as per below PR feat: add support for DefaultAzureCredential authentication mechanism #681

This commit adds support for the DefaultAzureCredential authentication mechanism in Azure Blob Storage. Users can now use the useDefaultAzureCredentials option to enable Azure's default credential chain, which automatically discovers and uses available credentials in the following order

Environment Variables (Service Principal)
Managed Identity
Azure CLI
Azure PowerShell
This is particularly useful when running on Azure Kubernetes Service (AKS) with
Workload Identity, eliminating the need to explicitly store credentials in
Kubernetes Secrets.

This will merge in 0.11.0 version.
But can you please tell me if i want to use this what i need to configure . I don’t know ant to use credentials or sas token directly. So will i required to use workload identity or managed identity. Could you please tell what is difference between managed identity and workload identity?

[dosubot]

To use DefaultAzureCredential for Azure Blob Storage backups in the plugin (from v0.11.0), you just need to set either useDefaultAzureCredentials: true or inheritFromAzureAD: true in your backup configuration. This lets the plugin use Azure's default credential chain—no need to provide explicit credentials or SAS tokens in Kubernetes secrets. Here’s a YAML example:

apiVersion: barmancloud.cnpg.io/v1
kind: ObjectStore
metadata:
  name: azure-store
spec:
  configuration:
    destinationPath: "https://<account-name>.blob.core.windows.net/<container>"
    azureCredentials:
      inheritFromAzureAD: true
      # or useDefaultAzureCredentials: true

Reference

For AKS:
If you want to avoid explicit credentials, you’ll need to use Azure AD Workload Identity or Managed Identity. In AKS, Workload Identity is the recommended approach. You must:

• Annotate the ServiceAccount used by your PostgreSQL cluster pods with your Azure AD application client ID.
• Configure Azure AD federated credentials to link to this ServiceAccount (subject format: system:serviceaccount:<namespace>:<serviceaccount-name>).
• Assign the "Storage Blob Data Contributor" role to your Azure AD application on the target storage account.
  Reference

Managed Identity vs. Workload Identity:

• Managed Identity is an Azure feature that gives an identity to Azure resources (like VMs or AKS nodes) so they can access other Azure services securely, without credentials in code.
• Workload Identity is a Kubernetes-native way for pods in AKS to access Azure resources. It federates Kubernetes ServiceAccounts with Azure AD identities, so your workloads (pods) can securely use Azure services without secrets.
  The plugin’s DefaultAzureCredential chain will use Managed Identity if available, or Workload Identity if configured in AKS.
  Reference

Best practice:
For production, follow Azure’s official guidance on credential chains and make sure your ServiceAccount and Azure AD setup are correct. All referenced Kubernetes resources (ServiceAccounts, ObjectStores) must be in the same namespace as your cluster.

Let me know if you need a step-by-step for AKS Workload Identity setup!

To reply, just mention @dosu.

---

^{How did I do? Good | Irrelevant | Incorrect | Verbose | Hallucination | Report 🐛 | Other}