feat: Add feature flag to gate the Azure Blob storage connector (#2029) (#2036)

feat: Add feature flag to gate the Azure Blob storage connector

Issue

- #2027

Summary

- Added `OPENRAG_AZURE_BLOB_ENABLED`, a standalone kill switch (default
  `true`) that force-hides the Azure Blob connector independently of
  `IBM_AUTH_ENABLED`, and wired it through every deployment surface.

Backend

- Added `is_azure_blob_enabled()` in `src/config/settings.py`, reading
  `OPENRAG_AZURE_BLOB_ENABLED` (default `true`).
- Updated `AzureBlobConnector.is_available()` to AND the new flag with
  the existing `IBM_AUTH_ENABLED` / `OPENRAG_DEV_AZURE_BLOB` gate.

Deployment

- Documented and defaulted the new env var in `.env.example` and
  `docker-compose.yml`.
- Threaded `OPENRAG_AZURE_BLOB_ENABLED` through the Helm chart
  (`values.yaml` `global.azureBlob.enabled`, `backend-dotenv.yaml`)
  and the Go operator's `env.go` default env vars.

Connector Access

- `governable_connector_types()` now drops `azure_blob` when
  `OPENRAG_AZURE_BLOB_ENABLED` is off, even if IBM auth is on.

Tests

- Added a unit test verifying `azure_blob` is excluded under the
  kill switch while `aws_s3` and `ibm_cos` remain governable.

Author: mpawlow

.env.example

@@ -170,6 +170,13 @@ AWS_SECRET_ACCESS_KEY=
 # dialog. Two auth modes are supported: a connection string, OR account name +
 # key (+ optional custom blob endpoint).
 #
+# Feature kill switch for the Azure Blob connector (default: true = enabled).
+# Independent of IBM_AUTH_ENABLED: set to false to force-hide the connector in
+# the UI even when IBM auth is on. When true, the connector still requires the
+# Enterprise/SaaS gate (IBM_AUTH_ENABLED) or OPENRAG_DEV_AZURE_BLOB below --
+# this flag is AND-ed with that gate, not an override.
+# OPENRAG_AZURE_BLOB_ENABLED=true
+#
 # Local dev / Azurite testing: set OPENRAG_DEV_AZURE_BLOB=true to enable the
 # connector without IBM_AUTH_ENABLED. NEVER use in production.
 # OPENRAG_DEV_AZURE_BLOB=false

docker-compose.yml

@@ -121,6 +121,7 @@ services:
       - UPLOAD_BATCH_SIZE=${UPLOAD_BATCH_SIZE:-25}
       - MAX_WORKERS=${MAX_WORKERS:-4}
       - IBM_AUTH_ENABLED=${IBM_AUTH_ENABLED:-false}
+      - OPENRAG_AZURE_BLOB_ENABLED=${OPENRAG_AZURE_BLOB_ENABLED:-true}
       - PLATFORM_AUTH_DEV_MODE=${PLATFORM_AUTH_DEV_MODE:-false}
       - PLATFORM_USERNAME=${PLATFORM_USERNAME}
       - PLATFORM_PASSWORD=${PLATFORM_PASSWORD}

enhancements/connectors/azure_blob/connector.py

@@ -19,7 +19,11 @@
 from posixpath import basename
 from typing import Any
 
-from config.settings import IBM_AUTH_ENABLED, is_dev_azure_blob_enabled
+from config.settings import (
+    IBM_AUTH_ENABLED,
+    is_azure_blob_enabled,
+    is_dev_azure_blob_enabled,
+)
 from connectors.base import BaseConnector, ConnectorDocument, DocumentACL
 from utils.logging_config import get_logger
 
@@ -71,17 +75,19 @@ class AzureBlobConnector(BaseConnector):
     SECRET_CONFIG_KEYS = ("connection_string", "account_key")
 
     # BaseConnector uses these for the default env-availability probe; the
-    # bucket-kind override below makes availability hinge on IBM_AUTH_ENABLED
-    # (or OPENRAG_DEV_AZURE_BLOB for local dev).
+    # bucket-kind override below makes availability hinge on the kill switch and
+    # IBM_AUTH_ENABLED (or OPENRAG_DEV_AZURE_BLOB for local dev).
     CLIENT_ID_ENV_VAR = "AZURE_STORAGE_ACCOUNT_NAME"
     CLIENT_SECRET_ENV_VAR = "AZURE_STORAGE_ACCOUNT_KEY"
 
     @classmethod
     def is_available(cls, manager, user_id=None) -> bool:
-        # Gated by feature flag like the other bucket connectors (aws_s3, ibm_cos).
-        # OPENRAG_DEV_AZURE_BLOB=true bypasses the IBM_AUTH_ENABLED requirement for
-        # local dev testing (e.g. against Azurite). Never use in production.
-        return IBM_AUTH_ENABLED or is_dev_azure_blob_enabled()
+        # OPENRAG_AZURE_BLOB_ENABLED is a kill switch (default true): set it false
+        # to force-hide the connector even when IBM auth is on. When true, the
+        # Enterprise/SaaS gate still applies -- IBM_AUTH_ENABLED like the other
+        # bucket connectors (aws_s3, ibm_cos), or OPENRAG_DEV_AZURE_BLOB=true to
+        # bypass IBM auth for local dev (e.g. against Azurite; never in production).
+        return is_azure_blob_enabled() and (IBM_AUTH_ENABLED or is_dev_azure_blob_enabled())
 
     @classmethod
     def register_routes(cls, app) -> None:

kubernetes/helm/openrag/templates/backend/backend-dotenv.yaml

@@ -103,6 +103,7 @@ stringData:
     {{- end }}
 
     # Azure Blob Storage connector (optional env defaults; gated by IBM_AUTH_ENABLED or OPENRAG_DEV_AZURE_BLOB)
+    OPENRAG_AZURE_BLOB_ENABLED={{ .Values.global.azureBlob.enabled }}
     {{- if .Values.global.azureBlob.connectionString }}
     AZURE_STORAGE_CONNECTION_STRING={{ .Values.global.azureBlob.connectionString | quote }}
     {{- end }}
@@ -210,7 +211,7 @@ stringData:
     {{- if .Values.backend.encryption.key }}
     OPENRAG_ENCRYPTION_KEY={{ .Values.backend.encryption.key  | quote }}
     {{- end }}
-    
+
     # Langflow auth (OpenRag uses this to determine how to authenticate with Langflow)
     LANGFLOW_AUTO_LOGIN={{ ternary "true" "false" .Values.langflow.auth.autoLogin }}
 

kubernetes/helm/openrag/values.yaml

@@ -60,12 +60,12 @@ global:
   # normally entered per-connection in the UI. Provide EITHER a connection string
   # OR account name + key (+ optional custom blob endpoint).
   azureBlob:
-    enabled: false
+    enabled: true                       # OPENRAG_AZURE_BLOB_ENABLED
     connectionString: ""                # AZURE_STORAGE_CONNECTION_STRING
     accountName: ""                     # AZURE_STORAGE_ACCOUNT_NAME
     accountKey: ""                      # AZURE_STORAGE_ACCOUNT_KEY
     endpoint: ""                        # AZURE_STORAGE_ENDPOINT (optional)
-      
+
 # ============================================================================
 # Langflow Configuration
 # ============================================================================
@@ -182,7 +182,7 @@ langflow:
         value: "langflow-db"
     sqlite:
       enabled: false
-      
+
   # Langfuse Tracking
   langfuse:
     secretKey: ""

kubernetes/operator/internal/controller/env.go

@@ -151,6 +151,8 @@ func NewEnvVarManager() *EnvVarManager {
 			// Azure Blob Storage connector (Enterprise/SaaS; gated by IBM_AUTH_ENABLED or OPENRAG_DEV_AZURE_BLOB for local dev).
 			// Optional env defaults — credentials are normally entered per-connection
 			// in the UI. Override via the CR spec.env when env-based defaults are wanted.
+			// OPENRAG_AZURE_BLOB_ENABLED is intentionally omitted: the backend defaults it to
+			// true (kill switch); set it via spec.env to force-hide the connector.
 			"AZURE_STORAGE_CONNECTION_STRING": "",
 			"AZURE_STORAGE_ACCOUNT_NAME":      "",
 			"AZURE_STORAGE_ACCOUNT_KEY":       "",

src/config/settings.py

@@ -258,6 +258,19 @@ def is_dev_azure_blob_enabled() -> bool:
     return raw in ("true", "1", "yes", "on")
 
 
+def is_azure_blob_enabled() -> bool:
+    """Feature kill switch for the Azure Blob connector (default: enabled).
+
+    Independent of ``IBM_AUTH_ENABLED``. Set ``OPENRAG_AZURE_BLOB_ENABLED=false``
+    to force-hide the connector in the UI even when IBM auth is on. When true
+    (the default), availability still requires the Enterprise/SaaS gate
+    (``IBM_AUTH_ENABLED``) or the ``OPENRAG_DEV_AZURE_BLOB`` dev bypass -- this
+    flag is subtractive (AND-ed with that gate), not an override.
+    """
+    raw = os.getenv("OPENRAG_AZURE_BLOB_ENABLED", "true").strip().lower()
+    return raw in ("true", "1", "yes", "on")
+
+
 def is_cloud_context() -> bool:
     """True when connector policy and SaaS settings guards should apply."""
     from utils.run_mode_utils import is_run_mode_saas

src/services/connector_access_service.py

@@ -23,11 +23,16 @@ def is_bucket_connector_type(connector_type: str) -> bool:
 
 def governable_connector_types() -> tuple[str, ...]:
     """Types shown in admin Connectors Permission — independent of the live connectors list."""
-    from config.settings import IBM_AUTH_ENABLED, is_cloud_context
+    from config.settings import IBM_AUTH_ENABLED, is_azure_blob_enabled, is_cloud_context
 
+    types = CONNECTOR_TYPES
+    # Honor the Azure Blob kill switch so a force-hidden connector doesn't linger
+    # as a governable row here (mirrors AzureBlobConnector.is_available()).
+    if not is_azure_blob_enabled():
+        types = tuple(t for t in types if t != "azure_blob")
     if is_cloud_context() and not IBM_AUTH_ENABLED:
-        return tuple(t for t in CONNECTOR_TYPES if t not in _BUCKET_CONNECTOR_TYPES)
-    return CONNECTOR_TYPES
+        types = tuple(t for t in types if t not in _BUCKET_CONNECTOR_TYPES)
+    return types
 
 
 async def get_access_map(session: AsyncSession) -> dict[str, bool]:

tests/unit/services/test_connector_access_service.py

@@ -162,6 +162,21 @@ def test_governable_connector_types_includes_buckets_with_ibm_auth(monkeypatch):
     assert "ibm_cos" in governable
 
 
+def test_governable_connector_types_excludes_azure_blob_when_kill_switch_off(monkeypatch):
+    # Kill switch off must hide azure_blob from the admin permission tab even
+    # when IBM auth is on (matches AzureBlobConnector.is_available()).
+    monkeypatch.setenv("OPENRAG_RUN_MODE", "saas")
+    monkeypatch.setattr("config.settings.IBM_AUTH_ENABLED", True)
+    monkeypatch.setenv("OPENRAG_AZURE_BLOB_ENABLED", "false")
+
+    governable = governable_connector_types()
+
+    assert "azure_blob" not in governable
+    # Other bucket connectors are unaffected by the Azure-specific kill switch.
+    assert "aws_s3" in governable
+    assert "ibm_cos" in governable
+
+
 @pytest.mark.asyncio
 async def test_list_access_for_admin_includes_disabled_types(session, monkeypatch):
     """Admin permission list is independent of the filtered connectors tab."""