Module azure 

An Azure Blob Storage implementation of Blob storage.

Structs

AzureBlob

Implementation of Blob backed by Azure Blob Storage.

AzureBlobConfig

Configuration for opening an AzureBlob.

ChainedCredential 🔒

A TokenCredential that tries each of its sources in order and returns the first token obtained.

FixedAssertion 🔒

A ClientAssertion that always supplies the same assertion.

RefreshingWorkloadIdentityCredential 🔒

A TokenCredential for AKS-style workload identity that re-reads the projected service account token file on every AAD access token refresh.

TimeoutCredential 🔒

A TokenCredential that fails token requests of inner that take longer than timeout.

Constants

AZURE_CLIENT_ID 🔒

AZURE_CLIENT_SECRET 🔒

AZURE_FEDERATED_TOKEN 🔒

AZURE_FEDERATED_TOKEN_FILE 🔒

AZURE_TENANT_ID 🔒

Environment variables that configure AKS-style workload identity and service principal credentials. The names match the ones the Azure SDKs’ default credential chains read.

EMULATOR_ACCOUNT 🔒

The account name of the Azurite emulator.

EMULATOR_ACCOUNT_KEY 🔒

The account key of the Azurite emulator’s EMULATOR_ACCOUNT.

GET_CONCURRENCY 🔒

Maximum number of partitions a blob get fetches at once.

GET_PARTITION_SIZE 🔒

Size of the ranges a blob get fetches concurrently.

MANAGED_IDENTITY_TIMEOUT 🔒

Maximum time the default credential chain waits for a managed identity token before trying the next credential. Outside of Azure the IMDS endpoint is unreachable, and the credential’s own retries would otherwise delay falling through to the Azure CLI by over a minute.

TOKEN_REFRESH_BUFFER 🔒

Time before an access token’s expiry at which its refresh task fetches a replacement, so requests keep being served from an unexpired token while the refresh round trip to AAD is in flight.

TOKEN_REFRESH_RETRY_INTERVAL 🔒

Minimum time a refresh task waits between fetch attempts once a refresh is due. This paces retries after failures, e.g. when AAD is transiently unreachable, and prevents hot-looping if issued tokens are already within TOKEN_REFRESH_BUFFER of expiry.

Functions

download_range 🔒

Downloads the partition of blob that starts at offset, or returns None if the blob does not exist.

download_total_len 🔒

Returns the total size of the blob a download response is for.

emulator_sas_token 🔒

Returns an account SAS query string that grants full access to the emulator’s blob service, signed with the emulator’s well-known account key.

fetch_token 🔒

Reads the projected service account token file and exchanges its contents for an AAD access token.

read_body 🔒

Reads a download’s body to its end.

redacted_url 🔒

Returns url without its query string, which may hold a SAS token.

refresh_task 🔒

Keeps slot holding an unexpired token by fetching a replacement within refresh_buffer of the current token’s expiry. A failed fetch leaves the current token in place and is retried after retry_interval.

token_credential 🔒

Returns the token credential to use when the blob URL carries no SAS token.

Type Aliases

ExchangeFn 🔒

Exchanges a client assertion (the projected service account token) for an AAD access token with the given scopes.

TokenSlot 🔒

A shared slot holding the current access token for one scope set.