<p>How do I create a secret to access Azure Blob storage if I am using SAS token authentication mode?</p>
<pre><code>{
    &quot;account_name&quot;: &quot;&lt;value&gt;&quot;,
    &quot;container_name&quot;: &quot;&lt;value&gt;&quot;,
    &quot;container_uri&quot;: &quot;&lt;value&gt;&quot;,
    &quot;region&quot;: &quot;&lt;value&gt;&quot;,
    &quot;sas_token&quot;: &quot;&lt;value&gt;&quot;
}
</code></pre>
<p>I cannot find any information about this on the docs</p>

bonijad383
<p>You create a SAS from the protal or via az cli:</p>
<pre class="lang-bash prettyprint-override"><code>AZURE_RESOURCE_GROUP=&quot;my-rg&quot;
AZURE_STORAGE_ACCOUNT=&quot;my-sa&quot;

export AZURE_STORAGE_CONNECTION_STRING=&quot;$(az storage account show-connection-string \
  --name &quot;$AZURE_STORAGE_ACCOUNT&quot; \
  --resource-group &quot;$AZURE_RESOURCE_GROUP&quot; \
  -o tsv)&quot;

AZURE_STORAGE_SAS_TOKEN=&quot;$(az storage account generate-sas \
  --services b \
  --resource-types co \
  --permissions dlpruwac \
  --expiry &quot;$(date -d '+7 days' '+%FT%H:%MZ')&quot; \
  -o tsv)&quot;
</code></pre>
<blockquote>
<p><strong>Note</strong> the --services, --resource-types and --permissions flags. In the above example the token was generated for blob storage, on container &amp; objects within the container with the permissions: delete, list, process, read, update, write, add &amp; create.</p>
</blockquote>
<pre><code>--permissions    [Required] :     The permissions the SAS grants. Allowed values: (a)dd (c)reate
                                  (d)elete (f)ilter_by_tags (i)set_immutability_policy (l)ist
                                  (p)rocess (r)ead (t)ag (u)pdate (w)rite (x)delete_previous_version
                                  (y)permanent_delete. Can be combined.
--resource-types [Required] :     The resource types the SAS is applicable for. Allowed values:
                                  (s)ervice (c)ontainer (o)bject. Can be combined.
--services       [Required] :     The storage services the SAS is applicable for. Allowed values:
                                  (b)lob (f)ile (q)ueue (t)able. Can be combined.
</code></pre>
<p>See more info with <code>az storage account generate-sas --help</code>.</p>
<p>Once you have the token you can create the secret (Note, you need the variables from the previous code snippet).</p>
<pre class="lang-bash prettyprint-override"><code>AZURE_STORAGE_ACCOUNT_CONTAINER=&quot;&lt;my-container&gt;&quot;

jq -n \
    --arg account_name &quot;$AZURE_STORAGE_ACCOUNT&quot; \
    --arg container_name &quot;$AZURE_STORAGE_ACCOUNT_CONTAINER&quot; \
    --arg container_uri &quot;$(az storage account show -n &quot;$AZURE_STORAGE_ACCOUNT&quot; -g &quot;$AZURE_RESOURCE_GROUP&quot; --query primaryEndpoints.blob -o tsv)$AZURE_STORAGE_ACCOUNT_CONTAINER&quot; \
    --arg region &quot;$(az storage account show -n &quot;$AZURE_STORAGE_ACCOUNT&quot; -g &quot;$AZURE_RESOURCE_GROUP&quot; --query primaryLocation -o tsv)&quot; \
    --arg sas_token &quot;$AZURE_STORAGE_SAS_TOKEN&quot; '{
    &quot;account_name&quot;: $account_name,
    &quot;container_name&quot;: $container_name,
    &quot;container_uri&quot;: $container_uri,
    &quot;region&quot;: $region,
    &quot;sas_token&quot;: $sas_token
    }' |
    kubectl create secret generic storage-account --from-file=data.json=/dev/stdin
</code></pre>
<p>You can change the name of the secret and the file name within the secret by modifying the kubectl command.</p>
<p>You also need to check if you should append the container name to the container uri yourself or if the library using this data is doing it. Above, I have added the container name, you may want to remove it from the uri.</p>
<p>If you dont need to append the container name to the uri, you could simplify the json generation like this below. Using a query to get multiple fields from az cli.</p>
<pre class="lang-bash prettyprint-override"><code>AZURE_STORAGE_ACCOUNT_CONTAINER=&quot;&lt;my-container&gt;&quot;

az storage account show -n $AZURE_STORAGE_ACCOUNT -g $AZURE_RESOURCE_GROUP \
    --query '{account_name:name,container_uri:primaryEndpoints.blob,region:primaryLocation}' |
    jq --arg sas_token &quot;$AZURE_STORAGE_SAS_TOKEN&quot; --arg container_name &quot;$AZURE_STORAGE_ACCOUNT_CONTAINER&quot; \
        '. + { &quot;sas_token&quot;: $sas_token, &quot;container_name&quot;: $container_name}' |
    kubectl create secret generic storage-account --from-file=data.json=/dev/stdin
</code></pre>
