Configure Microsoft Azure Blob storage for backups¶

This document guides you how to configure backups to the Azure Blob storage.

Create a Secret¶

Create a Secret with the following values:

the metadata.name key is the name which you will further use to refer your Kubernetes Secret,
the data.AZURE_STORAGE_ACCOUNT_NAME and data.AZURE_STORAGE_ACCOUNT_KEY keys are base64-encoded credentials used to access the storage.

The steps are:

Encode your Azure Storage account name and key using base64:

in Linux in macOS

echo -n 'plain-text-string' | base64 --wrap=0

echo -n 'plain-text-string' | base64

Create the Secrets file with these base64-encoded keys following the deploy/backup/backup-secret-azure.yaml example:

apiVersion: v1
kind: Secret
metadata:
  name: azure-secret
type: Opaque
data:
  AZURE_STORAGE_ACCOUNT_NAME: <YOUR-BASE64-ENCODED-ACCOUNT-NAME>
  AZURE_STORAGE_ACCOUNT_KEY: <YOUR-BASE64-ENCODED-ACCOUNT-KEY>

Create the Kubernetes Secret object as follows:

kubectl apply -f deploy/backup/backup-secret-azure.yaml -n <namespace>

Configure the storage¶

Edit the deploy/cr.yaml manifest and set:

storages.<NAME>.type to azure. Substitute the <NAME> part with some arbitrary name you will later use to refer this storage when making backups and restores.
storages.<NAME>.azure.credentialsSecret to the name used to refer your Kubernetes Secret (azure-secret in the last example).
storages.<NAME>.azure.container to the name of the Azure container .

Here is an example of the deploy/cr.yaml configuration file which configures Azure Blob storage named azure-blob for backups:

...
backup:
  ...
  storages:
    azure-blob:
      type: azure
      azure:
        container: <your-container-name>
        credentialsSecret: azure-secret
      ...

Depending on your setup, you may also need these options in the storages.<NAME>.azure subsection:

endpointUrl — set this if you use an Azure-compatible storage service instead of Azure itself, or need a non-default Azure endpoint. When empty, the Operator defaults to https://<storageAccount>.blob.core.windows.net/.
storageClass — the Azure storage tier to upload backups with, such as Hot, Cool, or Archive.
blockSize and concurrency — tune the block size and number of concurrent uploads for large backups.

For more configuration options, see the Operator Custom Resource options.

Next step¶

On-demand backup Scheduled backup

Last update: October 21, 2026
Created: October 21, 2026