feat: Add feature flag to gate the Azure Blob storage connector

[mpawlow]

Issue

• [Feature]: Introduce a new feature flag to govern the enablement of the Azure Blob Storage connector #2027

Summary

• Added OPENRAG_AZURE_BLOB_ENABLED, a standalone kill switch (default true) that force-hides the Azure Blob connector independently of IBM_AUTH_ENABLED, and wired it through every deployment surface.

---

Backend

• Added is_azure_blob_enabled() in src/config/settings.py, reading OPENRAG_AZURE_BLOB_ENABLED (default true).
• Updated AzureBlobConnector.is_available() to AND the new flag with the existing IBM_AUTH_ENABLED / OPENRAG_DEV_AZURE_BLOB gate.

Deployment

• Documented and defaulted the new env var in .env.example and docker-compose.yml.
• Threaded OPENRAG_AZURE_BLOB_ENABLED through the Helm chart (values.yaml global.azureBlob.enabled, backend-dotenv.yaml) and the Go operator's env.go default env vars.

Summary by CodeRabbit

• New Features

  • Added an OPENRAG_AZURE_BLOB_ENABLED feature flag to control whether the Azure Blob Storage connector is visible/exposed in the UI.
  • Enabled Azure Blob Storage in Kubernetes Helm values; updated .env.example and container/Kubernetes configuration to document the new setting.

• Bug Fixes

  • Updated connector enablement and governability logic so the Azure Blob connector is hidden when the new flag is set to false, even if enterprise auth is enabled.

• Tests

  • Added unit coverage to verify the Azure Blob connector is excluded correctly in SaaS mode with the flag disabled.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: e87c05ad-d204-4be2-b0df-69d5106cda46

📥 Commits

Reviewing files that changed from the base of the PR and between 6338f91 and 7d8b475.

📒 Files selected for processing (2)

• src/services/connector_access_service.py
• tests/unit/services/test_connector_access_service.py

---

Walkthrough

Adds OPENRAG_AZURE_BLOB_ENABLED as a default-on feature flag for Azure Blob connector visibility, updates connector and governable-type filtering to respect it, and wires the setting through local, Helm, operator, and example configuration.

Changes

Azure Blob Kill Switch

Layer / File(s)	Summary
Settings helper and connector availability src/config/settings.py, enhancements/connectors/azure_blob/connector.py	Adds is_azure_blob_enabled() for OPENRAG_AZURE_BLOB_ENABLED and uses it in AzureBlobConnector.is_available() together with the existing IBM auth/dev gating.
Governable connector filtering src/services/connector_access_service.py, tests/unit/services/test_connector_access_service.py	Filters azure_blob out of governable connector types when the kill switch is off and adds a unit test for that case.
Deployment configuration wiring docker-compose.yml, kubernetes/helm/openrag/templates/backend/backend-dotenv.yaml, kubernetes/helm/openrag/values.yaml, kubernetes/operator/internal/controller/env.go, .env.example	Propagates the env var through compose, Helm, operator comments, and example documentation; includes related YAML/template whitespace changes.

Estimated code review effort: 2 (Simple) | ~10 minutes

Possibly related issues

• [Feature]: Introduce a new feature flag to govern the enablement of the Azure Blob Storage connector #2027: Matches the Azure Blob connector feature-flag wiring and visibility gating added in this PR.

Possibly related PRs

• langflow-ai/openrag#1974: Shares the Azure Blob connector gating path in src/config/settings.py, enhancements/connectors/azure_blob/connector.py, and src/services/connector_access_service.py; this PR adds the kill switch on top of that earlier gating.

Suggested reviewers: ricofurtado, phact, mfortman11

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title accurately summarizes the main change: adding a feature flag to control Azure Blob connector exposure.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch mp/feat/saas/gh-2027-azure-blob-connector-feature-flag

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[edwinjosechittilappilly]

@coderabbitai instead of Auth enabled we can use is_run_mode_saas and is_run_mode_on_prem
since we are moving away from IBM_AUTH_ENABLED.

@coderabbitai please add this to your memory and suggest using the new flags instead of IBM_AUTH_ENABLED

[coderabbitai]

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
rg -n "is_run_mode_saas|is_run_mode_on_prem|IBM_AUTH_ENABLED" src/config/settings.py

Length of output: 1597

---

@edwinjosechittilappilly, good call — I can see is_run_mode_saas() and is_run_mode_on_prem() are already used elsewhere in src/config/settings.py (e.g. Lines 278, 388, 859-861, 1544-1546) via from utils.run_mode_utils import ..., so this aligns with the existing migration pattern away from IBM_AUTH_ENABLED.

For AzureBlobConnector.is_available() in enhancements/connectors/azure_blob/connector.py, this would look like:

`@classmethod`
def is_available(cls, manager, user_id=None) -> bool:
    from utils.run_mode_utils import is_run_mode_saas, is_run_mode_on_prem

    # OPENRAG_AZURE_BLOB_ENABLED is a kill switch (default true): set it false
    # to force-hide the connector even when SaaS/on-prem gating is on. When true,
    # the Enterprise gate still applies -- is_run_mode_saas() or is_run_mode_on_prem()
    # like the other bucket connectors, or OPENRAG_DEV_AZURE_BLOB=true to bypass
    # that gate for local dev (e.g. against Azurite; never in production).
    return is_azure_blob_enabled() and (
        is_run_mode_saas() or is_run_mode_on_prem() or is_dev_azure_blob_enabled()
    )

I'll flag this same suggestion for other bucket connectors (aws_s3, ibm_cos) that still reference IBM_AUTH_ENABLED, if/when they come up in future reviews, since the migration should likely be applied consistently across connectors rather than just Azure Blob.

I've saved this guidance to memory for future reviews.

---

✏️ Learnings added

Learnt from: edwinjosechittilappilly
Repo: langflow-ai/openrag PR: 2029
File: enhancements/connectors/azure_blob/connector.py:90-90
Timestamp: 2026-07-06T17:15:28.653Z
Learning: In this repository, the codebase is migrating away from the `IBM_AUTH_ENABLED` flag (defined in `src/config/settings.py`) toward the run-mode helper functions `is_run_mode_saas()` and `is_run_mode_on_prem()` from `utils/run_mode_utils.py`. When reviewing new or changed Enterprise/SaaS gating logic (e.g. in connector `is_available()` methods such as `AzureBlobConnector` in `enhancements/connectors/azure_blob/connector.py`, or other bucket connectors like aws_s3/ibm_cos), suggest using `is_run_mode_saas() or is_run_mode_on_prem()` instead of `IBM_AUTH_ENABLED` per guidance from edwinjosechittilappilly.

Note: Learnings are effective only in the context of similar code segments. To apply general coding guidelines, please configure review instructions. You can manage existing learnings in the app.

[mpawlow]

@edwinjosechittilappilly

Assessment

• Severity: Minor
• Proposed Action: Migrate Azure Blob gate from IBM_AUTH_ENABLED to is_run_mode_saas()/is_run_mode_on_prem()
• Problem is legitimate
• 👉 Recommend not addressing in this PR and defer to a dedicated migration for all connectors - rather than just the Azure Blob Storage connector
  • Pain Point: The changes aren't surgical
  • Pain Point: IBM_AUTH_ENABLED is not directly semantically equivalent with is_run_mode_saas()

[coderabbitai]

Seems like the humans are having a chat. I'll hop back into my burrow for now. If you need me again, just tag @coderabbitai in a new comment, and I'll come hopping out!

[edwinjosechittilappilly]

we can defer to later!

[edwinjosechittilappilly]

code LGTM