blob-storage

Generates a bash or Terraform snippet that creates an Azure Storage Account (StorageV2, LRS, hot tier) with one or more Blob containers, and grants the AKS kubelet identity (or a workload-identity service account) `Storage Blob Data Contributor` on it. For passwordless access from cluster workloads via workload identity. Optional private endpoint for hardening. Use as Stage 05 of `aks-bootstrap`, after `aks-cluster`. Trigger when the user mentions "create storage account", "blob container", "blob storage", "Storage Blob Data Contributor", or "passwordless blob access from AKS".

Zur Installation springen

Repository: NVIDIA-Omniverse/streaming-self-hosted
Letzte Quellaktivität: 13. Juli 2026 um 17:12
Erkannte Sprache von SKILL.md: Englisch
Sterne: 1
Forks: 2

Installationsoptionen

Standardmäßig ist der Prompt ausgewählt, der zuerst die Quelle prüft. Sie können zu einem direkten Befehl wechseln oder eine lokale Kopie herunterladen.

Mit Codex oder Claude installieren Kopieren Sie diesen Prompt, fügen Sie ihn in Codex, Claude oder einen anderen Assistant ein und lassen Sie die Skill-Seite prüfen und installieren.

Ein direkter Befehl überspringt den Prüf-Prompt. Prüfen Sie die Quelle, bevor Sie ihn ausführen.

npx skills add https://github.com/NVIDIA-Omniverse/streaming-self-hosted --skill blob-storage

Der Befehl bleibt in einer Zeile. Scrollen Sie horizontal, um ihn vor dem Kopieren vollständig zu prüfen.

Sie bevorzugen eine lokale Kopie? Laden Sie die Dateien herunter, die SkillsMP derzeit vorliegen.

Quelldateien prüfen

Lesen Sie SKILL.md und alle von SkillsMP angezeigten Begleitdateien, bevor Sie sich für eine Installation entscheiden.

SKILL.md

Quellanweisungen · Schreibgeschützte Vorschau

Zurück zur Suche Zurück zur Installation

name

blob-storage

description

Azure Blob Storage for cluster workloads

What this skill produces

Resource	Setting
`azurerm_storage_account`	StorageV2, LRS, hot access tier, HTTPS-only, TLS 1.2 minimum
`azurerm_storage_container` (one or more)	Private (no public access)
`azurerm_role_assignment`	`Storage Blob Data Contributor` to the kubelet identity (or specified workload identity) on the account scope
(optional) `azurerm_private_endpoint`	Private endpoint for hardening (set `STORAGE_PUBLIC_ACCESS=false`)

Inputs

Source from streaming-env.sh + generated/.env.iam-vpc + generated/.env.aks-cluster.

Required:

Variable	Description
`AZURE_SUBSCRIPTION_ID`	Subscription

#!/bin/bash set -euo pipefail # Resolve repo root from script location — works regardless of CWD. SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)" REPO_ROOT="$(cd "$SCRIPT_DIR/.." && pwd)" source "$REPO_ROOT/streaming-env.sh" if [[ ! -f "$REPO_ROOT/generated/.env.aks-cluster" ]]; then echo "ERROR: $REPO_ROOT/generated/.env.aks-cluster not found. Run stage02 first." >&2 exit 1 fi source "$REPO_ROOT/generated/.env.aks-cluster" : "${AZURE_SUBSCRIPTION_ID:?}" "${RESOURCE_GROUP:?}" "${LOCATION:?}" "${STORAGE_ACCOUNT_NAME:?}" "${STORAGE_CONTAINERS:?}" STORAGE_SKU="${STORAGE_SKU:-Standard_LRS}" STORAGE_TIER="${STORAGE_TIER:-Hot}" STORAGE_PUBLIC_ACCESS="${STORAGE_PUBLIC_ACCESS:-true}" STORAGE_GRANTEE_OBJECT_ID="${STORAGE_GRANTEE_OBJECT_ID:-$KUBELET_IDENTITY_OBJECT_ID}" STORAGE_GRANTEE_TYPE="${STORAGE_GRANTEE_TYPE:-ServicePrincipal}" if [[ ! "$STORAGE_ACCOUNT_NAME" =~ ^[a-z0-9]{3,24}$ ]]; then echo "ERROR: STORAGE_ACCOUNT_NAME='$STORAGE_ACCOUNT_NAME' must be 3–24 chars, lowercase alphanumeric only." exit 1 fi az account set --subscription "$AZURE_SUBSCRIPTION_ID" echo "--- Creating storage account $STORAGE_ACCOUNT_NAME ---" PUBLIC_FLAG=$([[ "$STORAGE_PUBLIC_ACCESS" == "false" ]] && echo "--public-network-access Disabled" || echo "--public-network-access Enabled") az storage account create \ --name "$STORAGE_ACCOUNT_NAME" \ --resource-group "$RESOURCE_GROUP" \ --location "$LOCATION" \ --sku "$STORAGE_SKU" \ --access-tier "$STORAGE_TIER" \ --kind StorageV2 \ --https-only true \ --min-tls-version TLS1_2 \ --allow-blob-public-access false \ $PUBLIC_FLAG \ --only-show-errors STORAGE_ID=$(az storage account show -n "$STORAGE_ACCOUNT_NAME" -g "$RESOURCE_GROUP" --query id -o tsv) STORAGE_ENDPOINT=$(az storage account show -n "$STORAGE_ACCOUNT_NAME" -g "$RESOURCE_GROUP" --query primaryEndpoints.blob -o tsv) echo "--- Creating containers: $STORAGE_CONTAINERS ---" IFS=',' read -ra CONTAINERS <<< "$STORAGE_CONTAINERS" for c in "${CONTAINERS[@]}"; do az storage container create \ --name "$c" \ --account-name "$STORAGE_ACCOUNT_NAME" \ --auth-mode login \ --only-show-errors >/dev/null echo " $c" done echo "--- Granting Storage Blob Data Contributor on $STORAGE_ACCOUNT_NAME ---" az role assignment create \ --assignee-object-id "$STORAGE_GRANTEE_OBJECT_ID" \ --assignee-principal-type "$STORAGE_GRANTEE_TYPE" \ --role "Storage Blob Data Contributor" \ --scope "$STORAGE_ID" \ --only-show-errors 2>&1 | grep -v "already exists" || true mkdir -p "$REPO_ROOT/generated" cat > "$REPO_ROOT/generated/.env.blob-storage" <<EOF export STORAGE_ACCOUNT_ID="$STORAGE_ID" export STORAGE_ACCOUNT_NAME="$STORAGE_ACCOUNT_NAME" export STORAGE_PRIMARY_ENDPOINT="$STORAGE_ENDPOINT" EOF echo "Wrote generated/.env.blob-storage"

Variable	Description	Default
`STORAGE_SKU`	Replication: `Standard_LRS` / `Standard_ZRS` / `Standard_GRS`	`Standard_LRS`
`STORAGE_TIER`	Access tier	`Hot`
`STORAGE_PUBLIC_ACCESS`	Allow public network access	`true` (set `false` + add private endpoint for prod)
`STORAGE_GRANTEE_OBJECT_ID`	AAD object ID to grant `Storage Blob Data Contributor`. Defaults to AKS kubelet identity.	`${KUBELET_IDENTITY_OBJECT_ID}`
`STORAGE_GRANTEE_TYPE`	`ServicePrincipal` (kubelet/workload identity) or `User`	`ServicePrincipal`
`OUTPUT_FORMAT`	`bash` or `terraform`	`bash`

Topic	Source
Storage Account naming	https://learn.microsoft.com/azure/azure-resource-manager/management/resource-name-rules#microsoftstorage
Blob RBAC roles	https://learn.microsoft.com/azure/storage/blobs/assign-azure-role-data-access
Workload identity → Blob	https://learn.microsoft.com/azure/aks/workload-identity-overview
Storage private endpoint	https://learn.microsoft.com/azure/storage/common/storage-private-endpoints

blob-storage

Installationsoptionen

Quelldateien prüfen

Azure Blob Storage for cluster workloads

What this skill produces

Inputs

Azure Blob Storage for cluster workloads

What this skill produces

Inputs

Outputs

Granting Workload Identity access (preferred over kubelet identity for least privilege)

Bash snippet (reference)

Terraform snippet (reference)

Hardening: private endpoint

Teardown

Validation checklist

References

blob-storage

Quellinformationen

Installationsoptionen

Quelldateien prüfen

Mehr aus diesem Repository

Mehr aus diesem Repository

Azure Blob Storage for cluster workloads

What this skill produces

Inputs

Azure Blob Storage for cluster workloads

What this skill produces

Inputs

Outputs

Granting Workload Identity access (preferred over kubelet identity for least privilege)

Bash snippet (reference)

Terraform snippet (reference)

Hardening: private endpoint

Teardown

Validation checklist

References