Azure Blob NFS for K8: Unable to see containers in azure storage account after pvcs are in bound.

Question

Azure Blob NFS for K8: Unable to see containers in azure storage account after pvcs are in bound.

Kaalasurya 20

I have kubernetes cluster in azure. For my application we want to use the azure blob nfs as pvc. Below is my storage class file. I configured pvc for it and added it to pod. PvC is in bound stage, pod is running fine and storage class is created but I cant see any container in the storage account in portal. Is there anything I am missing to make it work. I am using same storage class for 3 different pvcs . All 3 pvcs are in bound stage but still I cant see any containers in azure blob. All pods are running as well. Is there anything I am missing here. I am using 1.29.5 k8 version. I read somewhere we cant see containers in azure storage account portal created by azure blob nfs? Cant verify from any official docs though. apiVersion: storage.k8s.io/v1

kind: StorageClass

metadata:

name: azureblob-nfs

provisioner: blob.csi.azure.com

parameters:

secret: azure-sec

protocol: nfs

tags: environment=Development

volumeBindingMode: Immediate

allowVolumeExpansion: true

mountOptions:

- nconnect=4

Kaalasurya 20 Reputation points

2025-06-10T01:35:01.1233333+00:00

https://stackoverflow.com/questions/79659293/azure-nfs-blob-pvc-issue

Accepted answer

0 additional answers

Your answer

Kaalasurya 20 Reputation points

2025-06-10T01:35:01.1233333+00:00

https://stackoverflow.com/questions/79659293/azure-nfs-blob-pvc-issue

Answer 1

Nandamuri Pranay Teja 3,610 Microsoft External Staff Moderator

Hello Kaalasurya

Thank you for your question!

Blob storage with NFS 3.0 protocol support requires Azure Data Lake Storage Gen2 to be enabled for the storage account." It implies that when NFS is enabled, you're working with ADLS Gen2 capabilities. https://learn.microsoft.com/en-us/azure/storage/blobs/network-file-system-protocol-support

Enabling the NFSv3 protocol on an Azure Storage Account effectively activates the Hierarchical Namespace (HNS) feature, thereby converting the account into an ADLS Gen2 account. ADLS Gen2 accounts function with "Filesystems" (which are occasionally called "containers" in the context of ADLS Gen2 documentation, although they are different from the Blob Storage "Containers" blade).

These filesystems are intended for hierarchical directory structures. The blob.csi.azure.com provisioner, when utilizing protocol: nfs, provisions these ADLS Gen2 Filesystems, rather than the previous flat-namespace Blob Storage containers.

You are not missing anything. It's expected that you won't see these under "Blob Containers" because the CSI driver is creating ADLS Gen2 Filesystems. Look for them under the "File systems" blade in your storage account in the Azure portal.

In the Azure portal, navigate to your storage account.
In the left-hand menu, under the "Data storage" section, you need to click on "File systems".
Your PVCs bound to azureblob-nfs should correspond to entries in this "File systems" blade.

If you still don't see them under "File systems

Ensure your storage account is indeed a General-purpose v2 account and that Hierarchical Namespace is enabled on its "Configuration" blade. NFSv3 requires HNS. Check the logs of the blob-csi-driver pods (both controller and node components), typically in the kube-system namespace of your AKS cluster. These logs would show errors if provisioning failed due to permissions, network issues, or other problems.
The identity used by your AKS cluster (Service Principal or Managed Identity) needs the "Storage Blob Data Contributor" role on the storage account for the CSI driver to successfully create and manage these filesystems.

Hope the above answer helps! Please let us know do you have any further queries.

Please do not forget to "Accept the answer” and “up-vote” wherever the information provided helps you, this can be beneficial to other community members.

User's image

Kaalasurya 20 Reputation points

2025-06-10T06:26:52.4533333+00:00

Thanks for the reply. For storage account We are using block blob storage. Shoule we use general purpose v2 instead? Plus even though pvc is created and bound phase i can only see containers tab under data storage. Note: I am using kind of bloco blob storage anf nfs3, hierarchical ns are enabled.
Nandamuri Pranay Teja 3,610 Reputation points Microsoft External Staff Moderator

2025-06-10T07:14:20.83+00:00
Hello Kaalasurya

Yes, you should be using a General-purpose v2 (GPv2) storage account with Hierarchical Namespace (HNS) enabled for Azure Blob NFS to work.

If you're only seeing the "Containers" tab and not the "File systems" tab under "Data storage" for your storage account this indicates that Hierarchical Namespace (HNS) is NOT enabled on your current storage account, or your account is not a GPv2 account.

Go to your Storage Account in the Azure portal.

In the left-hand menu, under "Settings", click on "Configuration".

Check the "Account kind". It must be "StorageV2 (general purpose v2)".

Below that, look for "Hierarchical namespace". It must be "Enabled".

If it's "Disabled," you generally cannot enable it after creation if data already exists, or if it's a legacy account kind.

If your account kind is "BlockBlobStorage" (or "BlobStorage"), then HNS cannot be enabled on it at all.

Note- If your storage account's "Account kind" in the Azure portal (on the Overview blade) is explicitly listed as "BlockBlobStorage," then it's a specialized account optimized for block blobs and does NOT support Hierarchical Namespace (HNS) or NFSv3**.** You will only see the "Containers" blade for standard block blobs.

Hope the above answer helps! Please let us know do you have any further queries.

Please do not forget to "Accept the answer” and “up-vote” wherever the information provided helps you, this can be beneficial to other community members.
Nandamuri Pranay Teja 3,610 Reputation points Microsoft External Staff Moderator

2025-06-12T04:54:49.5033333+00:00

Hello Kaalasurya

Just checking in to see if the provided answer helped. If this answers your query, do click "Accept the answer” for the same, which might be beneficial to other community members reading this thread. And, if you have any further queries do let us know.
Kaalasurya 20 Reputation points

2025-06-19T07:23:45.5933333+00:00

Hi, We are trying to use the NFS with private endpoint. Now we gave networkendpoint: privateEndpoint [we created private endpoint]in storage class file and gave server: <storage account domain name>. While its trying to create pvc its hit with authorization failed with client id and object id. Is there any way to use managed identity or service principal of our own with nfs or we should provide permission to the client id is the only way < defaultone>. In documentation most parameters are not applicable for NFS.
Nandamuri Pranay Teja 3,610 Reputation points Microsoft External Staff Moderator

2025-06-19T08:44:30.6066667+00:00
Hello

Ensure your StorageClass is correctly configured for NFS with a private endpoint for example :

apiVersion: storage.k8s.io/v1 kind: StorageClass metadata: name: azurefile-nfs provisioner: file.csi.azure.com parameters: skuName: Premium_LRS protocol: nfs server: <storage-account-name>.file.core.windows.net networkEndpointType: privateEndpoint resourceGroup: <resource-group-name> storageAccount: <storage-account-name> # Optional: Specify user-assigned managed identity clientID: <user-assigned-managed-identity-client-id> reclaimPolicy: Delete volumeBindingMode: Immediate

Please be informed that protocol: nfs: Specifies NFS protocol. server: Use the storage account’s file endpoint (<storage-account-name>.file.core.windows.net). networkEndpointType: privateEndpoint: Indicates the private endpoint is used. clientID: If using a user-assigned managed identity, specify its client ID (optional; defaults to AKS cluster’s identity).

Confirm the storageAccount and resourceGroup match your Azure resources.

Ensure the server resolves to the private endpoint’s IP address in your AKS cluster’s VNet.
Kaalasurya 20 Reputation points

2025-06-19T08:58:59.3933333+00:00

Thanks for the response. We got error as in below comment. Note we are using azure blob nfs
Kaalasurya 20 Reputation points

2025-06-19T09:20:27.0466667+00:00

It said invalid argument desc = Inavlid parameter clientID in storage class. Is there any way to use dedicated one. Note we are using azure blob with nfs. If not dedicated one the only way is to give necessary permissions for the default client id? Please let us know of there is way to use our own managed identity/ service principal for this use case
Kaalasurya 20 Reputation points

2025-06-19T09:59:59.0966667+00:00

And also I read somewhere we can only use default identity for NFS. Is it not possible to use our own ones. Can you please clarify as we are facing below error

" failed to create container on account. Authorization failed. Code Authorization failed the client with object id does not have Authorization to perform action. If access was granted please refresh your creds"

We want to use new identity instead of default one assuming error was authorization issue.
Nandamuri Pranay Teja 3,610 Reputation points Microsoft External Staff Moderator

2025-06-19T16:43:42.5666667+00:00
Hello Kaalasurya

Thank you for the response!

Please be informed that even though if you're using NFS 3.0 protocol for Azure Blob Storage (ADLS Gen2) uses network-based authentication for data plane operations (reading/writing files once mounted), the CSI driver still needs Azure RBAC permissions to perform any action. The error your facting "failed to create container on account" suggests the CSI driver is trying to provision this.

Hence You need to ensure that the Managed Identity associated with your AKS cluster has the appropriate Azure RBAC role on the Azure Data Lake Storage Gen2 (Blob Storage) account.

Go to your AKS Cluster in the Azure portal. __Under "Settings", select "Properties"__Note the name or Object ID of the system-assigned managed identity (or your user-assigned managed identity if you've configured AKS to use a specific one for its control plane/kubelet). Post which Go to your Azure Data Lake Storage Gen2 (Blob Storage) Account

In the left-hand menu, select "Access control (IAM)"**Click on "+ Add" -> "Add role assignment"**On the "Role" tab, search for and select the role: **Storage Account Contributor**On the "Members" tab> For "Assign access to", select "Managed identity"> For "Managed identity", select the appropriate type: "Azure Kubernetes Service Cluster" (for system-assigned) or "User-assigned managed identity" (if you're using your custom one) >Select the specific Managed Identity of your AKS cluster> Click "Review + assign", and then "Review + assign" again to complete the assignment.

Hope the above answer helps! Please let us know do you have any further queries.

Share via

Azure Blob NFS for K8: Unable to see containers in azure storage account after pvcs are in bound.

0 additional answers

Your answer