Skip to main content
The Azure Blob Storage config source loads Orchestrator configuration from a blob stored in an Azure Storage container. The source is configured entirely through the MAVERICS_AZURE_CONFIG environment variable.
Console terminology: In the Maverics Console, Orchestrator instances and configuration delivery are managed through Deployments. When working directly with YAML, configuration is managed as files delivered via the -config flag or MAVERICS_CONFIG environment variable.

​
Prerequisites

  • An active Azure account — with access to the storage account and container where configuration is stored
  • A storage account and container — already provisioned in Azure (see the Console Azure Blob Storage setup guide)
  • A SAS token with read access — generated with List and Read permissions on the container (see steps below)

​
Overview

When the MAVERICS_AZURE_CONFIG environment variable is set, the Orchestrator fetches its YAML configuration from the specified Azure storage account, container, and blob path. The variable contains a JSON payload with connection details and SAS token authentication. The Orchestrator supports ETag-based change detection for automatic hot-reload.

​
Use Cases

  • Azure-native deployments — store configuration in Azure Storage alongside other Azure infrastructure resources
  • Azure DevOps pipelines — publish validated configuration to Blob Storage as part of Azure DevOps CI/CD workflows
  • Multi-region with Azure — leverage Azure Storage geo-replication to distribute configuration across regions

​
Generating a SAS Token

1

Navigate to Your Container

In the Azure portal, go to your storage account and select Containers under Data storage.Select the container that holds (or will hold) Orchestrator configuration.
2

Generate the SAS Token

Click the three-dot menu (or right-click) on the container and select Generate SAS.Set Signing method to Account key and Signing key to Key 1.Under Permissions, select List and Read only (the Orchestrator only needs to read configuration, not write it).Set an appropriate expiry date.Click Generate SAS token and URL.Copy the Blob SAS token value (starts with sv=) — use this as the token value in MAVERICS_AZURE_CONFIG.

​
Configuration

Console UI documentation is coming soon. This section will walk you through configuring this component using the Maverics Console’s visual interface, including step-by-step screenshots and field descriptions.

​
Configuration Reference

The MAVERICS_AZURE_CONFIG JSON payload supports the following fields:
FieldTypeRequiredDescription
accountstringYesAzure storage account name
containerstringYesBlob container name
tokenstringYesSAS token for authentication
configurationFilePathstringYesPath to the config file within the container
storageDomainstringNoStorage domain (default: blob.core.windows.net)
ETag-based hot-reload: When MAVERICS_RELOAD_CONFIG=true is set, the Orchestrator periodically checks the blob’s ETag. When the ETag changes (indicating the blob was updated), the Orchestrator reloads the configuration automatically.

​
Full Environment Example

A complete maverics.env file for an Orchestrator using Azure Blob Storage as its config source:
maverics.env
MAVERICS_DEBUG_MODE=true
MAVERICS_HTTP_ADDRESS=:443
MAVERICS_TLS_SERVER_CERT_FILE=your-cert.pem
MAVERICS_TLS_SERVER_KEY_FILE=your-private_key.pem
MAVERICS_RELOAD_CONFIG=true
MAVERICS_POLLING_INTERVAL_SECONDS=30
MAVERICS_BUNDLE_PUBLIC_KEY_FILE=./public_key.pem
MAVERICS_AZURE_CONFIG='{"token": "sv=2021-...", "account": "exampleStorage", "container": "exampleContainer", "configurationFilePath": "folder1/folder2"}'
Replace the placeholder values with your actual certificate paths, storage account name, container name, and SAS token.

​
Troubleshooting

  • Authentication failed — verify the SAS token has not expired. SAS tokens have a configurable expiration time. Generate a new token with read access to the blob.
  • Container not found — confirm the account and container values are correct. Container names are case-sensitive and must be lowercase.
  • Custom domain — if using Azure Government or a custom storage domain, set the storageDomain field (e.g., blob.core.usgovcloudapi.net).
  • Config not reloading — ensure MAVERICS_RELOAD_CONFIG=true is set. Check Orchestrator logs for ETag change detection messages.

Config Sources

Overview of all configuration sources

Amazon S3

Load config from AWS S3

Configuration Reference

Complete configuration field reference

Azure Blob Deployment Provider

Console-side Azure Blob Storage setup and SAS token generation