Skip to content

fix(azdls): load Azure credentials from environment variables#7225

Closed
rohankmr414 wants to merge 1 commit intoapache:mainfrom
rohankmr414:fix/azdls-workload-identity
Closed

fix(azdls): load Azure credentials from environment variables#7225
rohankmr414 wants to merge 1 commit intoapache:mainfrom
rohankmr414:fix/azdls-workload-identity

Conversation

@rohankmr414
Copy link

The azdls backend was not calling AzureStorageConfig::default().from_env() unlike the azblob backend, which meant Azure Workload Identity environment variables (AZURE_FEDERATED_TOKEN_FILE, AZURE_CLIENT_ID, AZURE_TENANT_ID, AZURE_AUTHORITY_HOST) were never loaded. This caused reqsign to skip the workload identity credential provider and fall through to IMDS, which fails in non-Azure-VM environments like AKS with Workload Identity.

This patch matches the pattern used in the azblob backend: start with from_env() and then overlay any explicitly configured values.

Which issue does this PR close?

Closes #7224.

Rationale for this change

The azdls backend was not loading Azure credentials from environment variables, unlike the azblob backend. Specifically, it was not calling AzureStorageConfig::default().from_env(), which meant Azure Workload Identity environment variables (AZURE_FEDERATED_TOKEN_FILE, AZURE_CLIENT_ID, AZURE_TENANT_ID, AZURE_AUTHORITY_HOST) were never loaded.

This caused reqsign to skip the workload identity credential provider and fall through to IMDS (Instance Metadata Service), which fails in non-Azure-VM environments like AKS (Azure Kubernetes Service) with Workload Identity enabled.

Note: We have been running this fix in an internal fork and can confirm it resolves the authentication issues in AKS with Workload Identity.

What changes are included in this PR?

  • Modified AzdlsBuilder::build() to use AzureStorageConfig::default().from_env() on non-wasm32 targets before overlaying explicitly configured values
  • This matches the pattern already used in the azblob backend (implemented in PR feat(core): Azblob supports azure workload identity #4705) for consistency
  • Ensures Azure Workload Identity credentials are properly loaded from environment variables when available

Are there any user-facing changes?

Yes - This is a bug fix that enables Azure Workload Identity authentication for the azdls backend.

Users running OpenDAL in Azure Kubernetes Service (AKS) with Workload Identity can now authenticate to Azure Data Lake Storage Gen2 using federated credentials without needing to explicitly configure credentials in code. The backend will automatically pick up the following environment variables:

  • AZURE_FEDERATED_TOKEN_FILE
  • AZURE_CLIENT_ID
  • AZURE_TENANT_ID
  • AZURE_AUTHORITY_HOST

This change is backward compatible - explicitly configured credentials still take precedence over environment variables.

AI Usage Statement

Augment Agent (Claude Sonnet 4.5) was used to help during implementation and resolve merge conflicts during rebase.

The azdls backend was not calling `AzureStorageConfig::default().from_env()`
unlike the azblob backend, which meant Azure Workload Identity environment
variables (AZURE_FEDERATED_TOKEN_FILE, AZURE_CLIENT_ID, AZURE_TENANT_ID,
AZURE_AUTHORITY_HOST) were never loaded. This caused reqsign to skip the
workload identity credential provider and fall through to IMDS, which fails
in non-Azure-VM environments like AKS with Workload Identity.

This patch matches the pattern used in the azblob backend: start with
`from_env()` and then overlay any explicitly configured values.
@rohankmr414 rohankmr414 requested a review from Xuanwo as a code owner February 26, 2026 08:06
@dosubot dosubot bot added size:M This PR changes 30-99 lines, ignoring generated files. releases-note/fix The PR fixes a bug or has a title that begins with "fix" labels Feb 26, 2026
@Xuanwo
Copy link
Member

Xuanwo commented Feb 26, 2026

Oh, sorry I missed this PR. #7226 should cover it.

@Xuanwo
Copy link
Member

Xuanwo commented Feb 26, 2026

#7226 has been merged. I'm going to close this PR now, we will have this in our next release.

@Xuanwo Xuanwo closed this Feb 26, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

releases-note/fix The PR fixes a bug or has a title that begins with "fix" size:M This PR changes 30-99 lines, ignoring generated files.

Projects

None yet

Development

Successfully merging this pull request may close these issues.

bug: azdls backend doesn't load Azure credentials from environment variables

2 participants