SAS token expiration issue

[beingvishalt]

Hi I am using Barman Cloud Plugin 0.9.0 with CNPG V1.26 on with AKS for taking backup on azure portal.

I created object store using SAS token + storage account, it worked perfectly.

But as SAS token expires after some specified duration we need to manually rotate in azure portal and put that in k8s secrete.

Is there any way to automate this, may be Barman plugin will generate SAS token or something like that

@dosu , please help

[dosubot]

The Barman Cloud Plugin does not support automatic SAS token generation or rotation for Azure Blob Storage—SAS tokens must be manually rotated in Azure and updated in your Kubernetes secret for continued access. There is no built-in mechanism for the plugin to generate or refresh SAS tokens on your behalf, and it relies on static credentials provided via secrets source.

To avoid manual SAS token management, you can use Azure AD Workload Identity authentication. This lets the plugin authenticate directly with Azure using a ServiceAccount annotated with your Azure AD application client ID, so you don’t need to manage SAS tokens or storage keys at all. To enable this, set azureCredentials.inheritFromAzureAD: true in your ObjectStore resource and ensure your ServiceAccount and Azure AD app are configured as described in the docs source.

If you must use SAS tokens, consider automating secret updates using tools like Azure automation scripts, CI/CD pipelines, or Kubernetes external secret operators to sync new tokens into your cluster when they are rotated in Azure.

A future CNPG feature will allow you to reuse a single ServiceAccount across clusters for Azure AD authentication, making this setup easier to manage at scale source.

For more details, see the official docs on Azure authentication methods.

To reply, just mention @dosu.

---

^{How did I do? Good | Irrelevant | Incorrect | Verbose | Hallucination | Report 🐛 | Other}