Configure block storage with private dns

[deggja]

Hello 🖖
I am trying to configure block storage for Mimir using the mimir-distributed helm chart. I have a storage account in Azure, behind a private endpoint. I'd like for Mimir to use that private endpoint fqdn instead of the default public one. I am also using workload identity, which is why there is no reference to a key in my code.

I cant find any examples on how to configure this. Is it possible?
The only documentation on this I can find suggests the following:

common:
  storage:
    backend: azure
    azure:
      account_key: "${AZURE_ACCOUNT_KEY}" # This is a secret injected via an environment variable
      account_name: mimir-prod
      endpoint_suffix: "blob.core.windows.net"

blocks_storage:
  azure:
    container_name: mimir-blocks

alertmanager_storage:
  azure:
    container_name: mimir-alertmanager

ruler_storage:
  azure:
    container_name: mimir-ruler

This wil not work, as the endpoint_suffix should be privatelink.blob.core.windows.net for this to correctly reference the fqdn of the private endpoint.

I tried configuring this the following way:

mimir:
      structuredConfig:
        common:
          storage:
            backend: azure
            azure:
              account_name: "${AZURE_ACCOUNT_NAME}"
              endpoint_suffix: "privatelink.blob.core.windows.net"

However, this results in a certificate error:

tls: failed to verify certificate: x509: certificate is valid for *.blob.core.windows.net, not storage-account.privatelink.blob.core.windows.net\ncreate

Anyone got any tips?

[deggja]

Okay so this was a bit confusing. However, I managed to figure it out and I will leave a comment here for anyone else looking to make this work.
The endpoint suffix should not be changed. It should remain default as is. When using a private endpoint in Azure, the public endpoint will become a cname for the private endpoint. Which means the default setting will work.

[kunalmehta-eve]

@deggja Thanks for the comment, what changes you had to do to use workoload-identity and provate end-point to make it work ?

[deggja]

@deggja Thanks for the comment, what changes you had to do to use workoload-identity and provate end-point to make it work ?

You should follow the docs for this. There is no additional setting required, thats what I misunderstood initially.