fix(azure): default endpoint_suffix to blob.core.windows.net#7687
Open
pujitha24 wants to merge 1 commit into
Open
fix(azure): default endpoint_suffix to blob.core.windows.net#7687pujitha24 wants to merge 1 commit into
pujitha24 wants to merge 1 commit into
Conversation
Motivation: After commit da2ad99 switched Cortex's Azure bucket client to Thanos' objstore, block-storage-dependent components (alertmanager, ruler, store-gateway, compactor, etc.) hang on startup when `endpoint_suffix` is left empty, failing with DNS errors and no clear message, e.g.: Get "https://<account>./<container>?restype=container": dial tcp: lookup <account>. on 192.168.5.3:53: no such host Root cause: Cortex builds the Thanos `azure.Config` struct directly in pkg/storage/bucket/azure/bucket_client.go and calls `NewBucketWithConfig`, which bypasses Thanos' `parseConfig`/`DefaultConfig` that would otherwise seed `Endpoint` with "blob.core.windows.net". Because Cortex's own `azure.endpoint-suffix` flag defaulted to "", the resulting FQDN was `<account>.`, which is invalid. Approach: Default the `azure.endpoint-suffix` flag to "blob.core.windows.net", matching Thanos' `DefaultConfig`. This restores the pre-da2ad99 out-of-the-box behavior for Azure public cloud while still allowing the value to be overridden for sovereign/government clouds. The connection-string / Azurite path is unaffected because Thanos never reads `Endpoint` when a connection string is set. Test config default and generated config docs are updated to match. Validation: go build ./... go test -tags "netgo slicelabels" ./pkg/storage/bucket/... make doc BUILD_IN_CONTAINER=false # regenerated config docs All passed. Fixes cortexproject#5449 Signed-off-by: Pujitha Paladugu <10557236+pujitha24@users.noreply.github.com>
dosubot
Bot
added
azure
component/alertmanager
component/compactor
component/rules
There was a problem hiding this comment.
Pull request overview
This PR fixes a regression in Cortex’s Azure object storage configuration by defaulting endpoint_suffix to the Azure public cloud value (blob.core.windows.net). This prevents Cortex from constructing an invalid FQDN (<account>.) when Cortex directly instantiates Thanos’ azure.Config and bypasses Thanos’ internal defaulting logic.
Changes:
- Default
azure.endpoint-suffixflag toblob.core.windows.net. - Update the Azure config default test to match the new flag default.
- Update generated configuration docs and add a changelog entry documenting the behavior change.
Reviewed changes
Copilot reviewed 6 out of 6 changed files in this pull request and generated 2 comments.
Show a summary per file
| File | Description |
|---|---|
| pkg/storage/bucket/azure/config.go | Changes the CLI flag default for Azure endpoint-suffix to a valid public cloud suffix. |
| pkg/storage/bucket/azure/config_test.go | Updates the default-config assertion to include the new Endpoint default. |
| docs/configuration/config-file-reference.md | Updates the documented default for endpoint_suffix across relevant Azure config blocks. |
| docs/blocks-storage/store-gateway.md | Updates the documented default for endpoint_suffix in store-gateway config docs. |
| docs/blocks-storage/querier.md | Updates the documented default for endpoint_suffix in querier config docs. |
| CHANGELOG.md | Documents the Azure defaulting bugfix and its impact. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Comment on lines
34
to
+36
| f.Var(&cfg.StorageConnectionString, prefix+"azure.connection-string", "The values of `account-name` and `endpoint-suffix` values will not be ignored if `connection-string` is set. Use this method over `account-key` if you need to authenticate via a SAS token or if you use the Azurite emulator.") | ||
| f.StringVar(&cfg.ContainerName, prefix+"azure.container-name", "", "Azure storage container name") | ||
| f.StringVar(&cfg.Endpoint, prefix+"azure.endpoint-suffix", "", "Azure storage endpoint suffix without schema. The account name will be prefixed to this value to create the FQDN") | ||
| f.StringVar(&cfg.Endpoint, prefix+"azure.endpoint-suffix", "blob.core.windows.net", "Azure storage endpoint suffix without schema. The account name will be prefixed to this value to create the FQDN") |
Comment on lines
858
to
+861
| # Azure storage endpoint suffix without schema. The account name will be | ||
| # prefixed to this value to create the FQDN | ||
| # CLI flag: -alertmanager-storage.azure.endpoint-suffix | ||
| [endpoint_suffix: <string> | default = ""] | ||
| [endpoint_suffix: <string> | default = "blob.core.windows.net"] |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Motivation:
After commit da2ad99 switched Cortex's Azure bucket client to Thanos'
objstore, block-storage-dependent components (alertmanager, ruler,
store-gateway, compactor, etc.) hang on startup when
endpoint_suffixis left empty, failing with DNS errors and no clear message, e.g.:
Root cause: Cortex builds the Thanos
azure.Configstruct directly inpkg/storage/bucket/azure/bucket_client.go and calls
NewBucketWithConfig, which bypasses Thanos'parseConfig/DefaultConfigthat would otherwise seed
Endpointwith "blob.core.windows.net". BecauseCortex's own
azure.endpoint-suffixflag defaulted to "", the resultingFQDN was
<account>., which is invalid.Approach:
Default the
azure.endpoint-suffixflag to "blob.core.windows.net",matching Thanos'
DefaultConfig. This restores the pre-da2ad99out-of-the-box behavior for Azure public cloud while still allowing the
value to be overridden for sovereign/government clouds. The
connection-string / Azurite path is unaffected because Thanos never reads
Endpointwhen a connection string is set.Test config default and generated config docs are updated to match.
Validation:
go build ./...
go test -tags "netgo slicelabels" ./pkg/storage/bucket/...
make doc BUILD_IN_CONTAINER=false # regenerated config docs
All passed.
Fixes #5449
Signed-off-by: Pujitha Paladugu 10557236+pujitha24@users.noreply.github.com