[kyleknap]

What?

Adds support for Azure Storage connection strings for AZURE_BLOB plugin. When set using the connection_string backend parameter or AZURE_STORAGE_CONNECTION_STRING env var, it overrides the account URL and auth is sourced from the connection string instead of default Azure credentials.

In addition, nixlbench and the end to end tests were updated to accept connection strings to be able to test directly against Azurite.

Why?

This allows to easily connect to Azurite for local testing instead of requiring authentication using Microsoft Entra Id and making actual API requests to Azure Blob Storage. While technically, you can use OAuth to communicate to Azurite, it requires additional scaffolding that is not as straightforward as just providing its well-known connection string.

Summary by CodeRabbit

• New Features

  • Azure Blob backend now supports connection string as an alternative to account URL, providing greater authentication flexibility.
  • Added support for connecting to Azurite, enabling local testing of Azure Blob operations.

• Documentation

  • Updated documentation with Azurite setup instructions and connection examples for the Azure Blob backend.

[copy-pr-bot]

This pull request requires additional validation before any workflows can run on NVIDIA's runners.

Pull request vetters can view their responsibilities here.

Contributors can view more details about this message here.

[github-actions]

👋 Hi kyleknap! Thank you for contributing to ai-dynamo/nixl.

Your PR reviewers will review your contribution then trigger the CI to test your changes.

🚀

[coderabbitai]

📝 Walkthrough

Walkthrough

This change introduces Azure Blob connection string support as an alternative authentication method to account URL across the nixlbench benchmark and Azure Blob plugin. Documentation is expanded with Azurite configuration guidance, and logic updated to prefer connection string when available, with account URL as fallback.

Changes

Cohort / File(s)	Summary
Documentation Updates benchmark/nixlbench/README.md, src/plugins/azure_blob/README.md	Added configuration documentation for azure_blob_connection_string/connection_string parameter, Azurite connection guidance, Docker setup instructions, and environment variable references for local testing workflows.
Configuration Infrastructure benchmark/nixlbench/src/utils/utils.h, benchmark/nixlbench/src/utils/utils.cpp	Declared and implemented azure_blob_connection_string static member in xferBenchConfig; updated parameter loading, printing, and buildCommonAzCliBlobParams logic to prefer connection string over account URL with proper error handling when both are absent.
Azure Blob Backend Implementation src/plugins/azure_blob/azure_blob_client.cpp	Extended client initialization to support connection string path; added getConnectionString helper; modified blobServiceClient creation to use CreateFromConnectionString when connection string is available, falling back to account URL with credentials, with improved error messaging.
Test Updates test/gtest/plugins/azure_blob/azure_blob_test.cpp	Updated test fixture to accept both AZURE_STORAGE_ACCOUNT_URL and AZURE_STORAGE_CONNECTION_STRING; modified setupTestContainer signature and implementation to support dual credential paths with branching logic for client creation.
Worker Integration benchmark/nixlbench/src/worker/nixl/nixl_worker.cpp	Integrated new connection_string parameter into Azure Blob backend initialization sourced from xferBenchConfig.

Estimated code review effort

🎯 3 (Moderate) | ⏱️ ~20 minutes

Poem

🐰 A string of connection, so clever and new,
No account URL needed—Azurite breakthrough!
Local tests hopping, the config takes flight,
Fallback paths ready, the auth shines so bright! ✨

🚥 Pre-merge checks | ✅ 2 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 9.09% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (2 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title 'Add connection string support to AZURE_BLOB plugin' clearly and concisely describes the main change in the PR, which is adding connection string support to the Azure Blob plugin across multiple files and components.
Description check	✅ Passed	The PR description addresses two of three required sections. The 'What?' section clearly explains the feature added, and the 'Why?' section provides compelling justification about Azurite testing. However, the 'How?' section (optional but recommended for complex changes) is missing.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

• 📝 Generate docstrings (stacked PR)
• 📝 Generate docstrings (commit on current branch)

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Post copyable unit tests in a comment

Tip

Issue Planner is now in beta. Read the docs and try it out! Share your feedback on Discord.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[coderabbitai]

Actionable comments posted: 2

Caution

Some comments are outside the diff and can’t be posted inline due to platform limitations.

⚠️ Outside diff range comments (1)

benchmark/nixlbench/src/utils/utils.cpp (1)

629-636: ⚠️ Potential issue | 🟠 Major

Do not print full Azure connection strings to stdout.
Line 634 prints the entire connection string, which embeds an account key and will leak secrets into logs and shells. Please redact or omit the value.

🔒 Proposed redaction

-            printOption("Azure Blob Storage connection string "
-                        "(--azure_blob_connection_string=connection-string)",
-                        azure_blob_connection_string);
+            if (!azure_blob_connection_string.empty()) {
+                printOption("Azure Blob Storage connection string "
+                            "(--azure_blob_connection_string=connection-string)",
+                            "<redacted>");
+            }

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@benchmark/nixlbench/src/utils/utils.cpp` around lines 629 - 636, The print of
azure_blob_connection_string in utils.cpp (call site using printOption when
backend == XFERBENCH_BACKEND_AZURE_BLOB) leaks secrets—change the behavior to
avoid printing the full connection string: either omit the value entirely or
replace it with a redacted placeholder (e.g., "<redacted>" or show only a
non-sensitive suffix/prefix). Update the printOption invocation for
azure_blob_connection_string so it passes a redacted string instead of the raw
azure_blob_connection_string variable (or add a small helper that masks the
secret) while keeping the descriptive label unchanged.

🤖 Prompt for all review comments with AI agents

Verify each finding against the current code and only fix it if needed.

Inline comments:
In `@benchmark/nixlbench/README.md`:
- Around line 779-809: Replace the hard-coded Azurite account key string with a
placeholder or env var (e.g. use '<AZURITE_CONNECTION_STRING>' or an environment
variable) wherever it's used (the az storage container create
--connection-string and the --azure_blob_connection_string CLI flag), and add
blank lines before and after each fenced code block to address MD031 so all
fenced blocks in README.md are separated by blank lines.

In `@src/plugins/azure_blob/README.md`:
- Around line 114-149: The README contains literal Azurite connection strings
and missing blank lines around fenced blocks; remove the hard-coded AccountKey
and connection string values and replace them with a placeholder (e.g.,
<AZURITE_CONNECTION_STRING>) and environment variable references
(AZURE_STORAGE_CONNECTION_STRING / AZURE_STORAGE_CONTAINER_NAME) wherever the
examples show the connection string (the bash az storage container create
command, the nixl_b_params_t connection_string entry, and the export lines), and
ensure there is a blank line before and after each fenced code block to satisfy
MD031; keep references to agent.createBackend("AZURE_BLOB", ... ) and
nixl_b_params_t so the examples still demonstrate usage but without secrets.

---

Outside diff comments:
In `@benchmark/nixlbench/src/utils/utils.cpp`:
- Around line 629-636: The print of azure_blob_connection_string in utils.cpp
(call site using printOption when backend == XFERBENCH_BACKEND_AZURE_BLOB) leaks
secrets—change the behavior to avoid printing the full connection string: either
omit the value entirely or replace it with a redacted placeholder (e.g.,
"<redacted>" or show only a non-sensitive suffix/prefix). Update the printOption
invocation for azure_blob_connection_string so it passes a redacted string
instead of the raw azure_blob_connection_string variable (or add a small helper
that masks the secret) while keeping the descriptive label unchanged.

---

ℹ️ Review info

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro

📥 Commits

Reviewing files that changed from the base of the PR and between 77b9ab7 and 62fa0b8.

📒 Files selected for processing (7)

• benchmark/nixlbench/README.md
• benchmark/nixlbench/src/utils/utils.cpp
• benchmark/nixlbench/src/utils/utils.h
• benchmark/nixlbench/src/worker/nixl/nixl_worker.cpp
• src/plugins/azure_blob/README.md
• src/plugins/azure_blob/azure_blob_client.cpp
• test/gtest/plugins/azure_blob/azure_blob_test.cpp

[ovidiusm]

/build

[ovidiusm]

/build

[ovidiusm]

/ok to test 56855be

[ovidiusm]

/build