feat(operator-wandb): use deployment-wide Azure storage identity

.github/workflows/test-operator-wandb.yaml

@@ -29,6 +29,8 @@ jobs:
           popd
           helm plugin install https://github.com/origranot/helm-cascade
           helm cascade build ./charts/operator-wandb/
+          helm plugin install https://github.com/helm-unittest/helm-unittest.git --version v1.1.1
+          helm unittest --file 'tests/azure_storage_auth_test.yaml' ./charts/operator-wandb/
           helm plugin install https://github.com/jlandowner/helm-chartsnap
           ./snapshots.sh run
       # currently this action always tries to install helm, so dont use it for now

charts/lumen/Chart.lock

@@ -1,9 +1,9 @@
 dependencies:
 - name: wandb-base
   repository: file://../wandb-base
-  version: 0.12.5
+  version: 0.12.6
 - name: wandb-base
   repository: file://../wandb-base
-  version: 0.12.5
-digest: sha256:bcdecca7a05ea099496166ece8dadd0ed4735cfdfa10969debebadf4975ba6f5
-generated: "2026-07-28T13:31:57.307079-05:00"
+  version: 0.12.6
+digest: sha256:60d1023fe307cba27e2dfe573be514601dc0dcacb6d72f91323615fedaa42772
+generated: "2026-07-29T18:00:40.632395-05:00"

charts/lumen/Chart.yaml

@@ -2,7 +2,7 @@ apiVersion: v2
 name: lumen
 description: A Helm chart for deploying the W&B Lumen processor and notebook
 type: application
-version: 0.2.4
+version: 0.2.5
 appVersion: 1.0.0
 
 maintainers:
@@ -13,9 +13,9 @@ maintainers:
 dependencies:
   - name: wandb-base
     alias: processor
-    version: "0.12.5"
+    version: "0.12.6"
     repository: file://../wandb-base
   - name: wandb-base
     alias: notebook
-    version: "0.12.5"
+    version: "0.12.6"
     repository: file://../wandb-base

charts/operator-wandb/Chart.lock

@@ -1,43 +1,43 @@
 dependencies:
 - name: wandb-base
   repository: file://../wandb-base
-  version: 0.12.5
+  version: 0.12.6
 - name: wandb-base
   repository: file://../wandb-base
-  version: 0.12.5
+  version: 0.12.6
 - name: wandb-base
   repository: file://../wandb-base
-  version: 0.12.5
+  version: 0.12.6
 - name: wandb-base
   repository: file://../wandb-base
-  version: 0.12.5
+  version: 0.12.6
 - name: wandb-base
   repository: file://../wandb-base
-  version: 0.12.5
+  version: 0.12.6
 - name: wandb-base
   repository: file://../wandb-base
-  version: 0.12.5
+  version: 0.12.6
 - name: wandb-base
   repository: file://../wandb-base
-  version: 0.12.5
+  version: 0.12.6
 - name: wandb-base
   repository: file://../wandb-base
-  version: 0.12.5
+  version: 0.12.6
 - name: wandb-base
   repository: file://../wandb-base
-  version: 0.12.5
+  version: 0.12.6
 - name: wandb-base
   repository: file://../wandb-base
-  version: 0.12.5
+  version: 0.12.6
 - name: wandb-base
   repository: file://../wandb-base
-  version: 0.12.5
+  version: 0.12.6
 - name: wandb-base
   repository: file://../wandb-base
-  version: 0.12.5
+  version: 0.12.6
 - name: wandb-base
   repository: file://../wandb-base
-  version: 0.12.5
+  version: 0.12.6
 - name: mysql
   repository: file://charts/mysql
   version: 0.1.0
@@ -61,19 +61,19 @@ dependencies:
   version: 0.1.0
 - name: wandb-base
   repository: file://../wandb-base
-  version: 0.12.5
+  version: 0.12.6
 - name: wandb-base
   repository: file://../wandb-base
-  version: 0.12.5
+  version: 0.12.6
 - name: wandb-base
   repository: file://../wandb-base
-  version: 0.12.5
+  version: 0.12.6
 - name: wandb-base
   repository: file://../wandb-base
-  version: 0.12.5
+  version: 0.12.6
 - name: wandb-base
   repository: file://../wandb-base
-  version: 0.12.5
+  version: 0.12.6
 - name: stackdriver
   repository: file://charts/stackdriver
   version: 0.1.0
@@ -82,39 +82,39 @@ dependencies:
   version: 0.1.0
 - name: wandb-base
   repository: file://../wandb-base
-  version: 0.12.5
+  version: 0.12.6
 - name: wandb-base
   repository: file://../wandb-base
-  version: 0.12.5
+  version: 0.12.6
 - name: wandb-base
   repository: file://../wandb-base
-  version: 0.12.5
+  version: 0.12.6
 - name: wandb-base
   repository: file://../wandb-base
-  version: 0.12.5
+  version: 0.12.6
 - name: wandb-base
   repository: file://../wandb-base
-  version: 0.12.5
+  version: 0.12.6
 - name: wandb-base
   repository: file://../wandb-base
-  version: 0.12.5
+  version: 0.12.6
 - name: wandb-base
   repository: file://../wandb-base
-  version: 0.12.5
+  version: 0.12.6
 - name: wandb-base
   repository: file://../wandb-base
-  version: 0.12.5
+  version: 0.12.6
 - name: wandb-base
   repository: file://../wandb-base
-  version: 0.12.5
+  version: 0.12.6
 - name: wandb-base
   repository: file://../wandb-base
-  version: 0.12.5
+  version: 0.12.6
 - name: reloader
   repository: https://stakater.github.io/stakater-charts
   version: 1.3.0
 - name: clickhouse
   repository: file://charts/clickhouse
   version: 9.1.1
-digest: sha256:c184b462210609f094cf2064dffeb2c2aeebb22e6af809ec45d1f1b0ba91df91
-generated: "2026-07-29T16:15:40.380955-04:00"
+digest: sha256:039ae3137a49174b04980ea7cafdd5f83fc517a898b577278b76a587b1723266
+generated: "2026-08-05T08:44:45.513577-05:00"

charts/operator-wandb/Chart.yaml

@@ -2,7 +2,7 @@ apiVersion: v2
 name: operator-wandb
 description: A Helm chart for deploying W&B to Kubernetes
 type: application
-version: 0.43.10
+version: 0.44.0
 appVersion: 1.0.0
 icon: https://wandb.ai/logo.svg
 
@@ -14,67 +14,67 @@ maintainers:
 dependencies:
   - name: wandb-base
     alias: app
-    version: "0.12.5"
+    version: "0.12.6"
     repository: file://../wandb-base
     condition: app.install
   - name: wandb-base
     alias: appRenamePreHook
-    version: "0.12.5"
+    version: "0.12.6"
     repository: file://../wandb-base
     condition: appRenamePreHook.install
   - name: wandb-base
     alias: appRenamePostHook
-    version: "0.12.5"
+    version: "0.12.6"
     repository: file://../wandb-base
     condition: appRenamePostHook.install
   - name: wandb-base
     alias: api
     condition: global.api.enabled
     repository: file://../wandb-base
-    version: "0.12.5"
+    version: "0.12.6"
   - name: wandb-base
     alias: console
-    version: "0.12.5"
+    version: "0.12.6"
     repository: file://../wandb-base
     condition: console.install
   - name: wandb-base
     alias: weave
-    version: "0.12.5"
+    version: "0.12.6"
     repository: file://../wandb-base
     condition: weave.install
   - name: wandb-base
     alias: weave-trace
-    version: "0.12.5"
+    version: "0.12.6"
     repository: file://../wandb-base
     condition: weave-trace.install
   - name: wandb-base
     alias: weave-trace-worker
-    version: "0.12.5"
+    version: "0.12.6"
     repository: file://../wandb-base
     condition: weave-trace-worker.install
   - name: wandb-base
     alias: weave-evaluate-model-worker
-    version: "0.12.5"
+    version: "0.12.6"
     repository: file://../wandb-base
     condition: weave-evaluate-model-worker.install
   - name: wandb-base
     alias: weave-trace-agent-scoring-worker
-    version: "0.12.5"
+    version: "0.12.6"
     repository: file://../wandb-base
     condition: weave-trace-agent-scoring-worker.install
   - name: wandb-base
     alias: executor
-    version: "0.12.5"
+    version: "0.12.6"
     repository: file://../wandb-base
     condition: executor.install
   - name: wandb-base
     alias: parquet
-    version: "0.12.5"
+    version: "0.12.6"
     repository: file://../wandb-base
     condition: parquet.install
   - name: wandb-base
     alias: parquet-metadata-cache
-    version: "0.12.5"
+    version: "0.12.6"
     repository: file://../wandb-base
     condition: parquet-metadata-cache.install
   - name: mysql
@@ -109,20 +109,20 @@ dependencies:
     alias: flat-run-fields-updater
     condition: flat-run-fields-updater.install
     repository: file://../wandb-base
-    version: "0.12.5"
+    version: "0.12.6"
   - name: wandb-base
     alias: history-updater
     condition: history-updater.install
     repository: file://../wandb-base
-    version: "0.12.5"
+    version: "0.12.6"
   - name: wandb-base
     alias: run-store-accelerator-run-updater
     condition: run-store-accelerator-run-updater.install
     repository: file://../wandb-base
-    version: "0.12.5"
+    version: "0.12.6"
   - name: wandb-base
     alias: filestream
-    version: "0.12.5"
+    version: "0.12.6"
     repository: file://../wandb-base
     condition: filestream.install
   - name: wandb-base
@@ -142,52 +142,52 @@ dependencies:
     alias: frontend
     condition: frontend.install
     repository: file://../wandb-base
-    version: "0.12.5"
+    version: "0.12.6"
   - name: wandb-base
     alias: filemeta
     condition: filemeta.install
     repository: file://../wandb-base
-    version: "0.12.5"
+    version: "0.12.6"
   - name: wandb-base
     alias: anaconda2
     condition: anaconda2.install
     repository: file://../wandb-base
-    version: "0.12.5"
+    version: "0.12.6"
   - name: wandb-base
     alias: internalSignerPreHook
     condition: global.localService.bypass
     repository: file://../wandb-base
-    version: "0.12.5"
+    version: "0.12.6"
   - name: wandb-base
     alias: metric-observer
     condition: metric-observer.install
     repository: file://../wandb-base
-    version: "0.12.5"
+    version: "0.12.6"
   - name: wandb-base
     alias: glue
     condition: global.glue.enabled
     repository: file://../wandb-base
-    version: "0.12.5"
+    version: "0.12.6"
   - name: wandb-base
     alias: settingsMigrationJob
     condition: settingsMigrationJob.install
     repository: file://../wandb-base
-    version: "0.12.5"
+    version: "0.12.6"
   - name: wandb-base
     alias: clickhouseMigrationJob
     condition: clickhouseMigrationJob.install
     repository: file://../wandb-base
-    version: "0.12.5"
+    version: "0.12.6"
   - name: wandb-base
     alias: mcp-server
     condition: mcp-server.install
     repository: file://../wandb-base
-    version: "0.12.5"
+    version: "0.12.6"
   - name: wandb-base
     alias: lumen-agent
     condition: lumen-agent.install
     repository: file://../wandb-base
-    version: "0.12.5"
+    version: "0.12.6"
   - name: reloader
     condition: reloader.install
     version: 1.3.0

charts/operator-wandb/charts/bufstream/templates/_helpers.tpl

@@ -20,6 +20,34 @@ Helpers to allow overriding the namespace
 {{- default .Release.Namespace .Values.namespaceOverride | trunc 63 | trimSuffix "-" -}}
 {{- end -}}
 
+{{/*
+Select the umbrella chart's Azure storage ServiceAccount when Bufstream uses
+the deployment-wide identity. Bucket-scoped identity and key-based BYOB retain
+the component account.
+*/}}
+{{- define "bufstream.azureStorageServiceAccountEnabled" -}}
+  {{- $identity := default (dict) .Values.global.azureStorageIdentity -}}
+  {{- $globalConfigured := and (not (empty $identity.tenantId)) (not (empty $identity.clientId)) -}}
+  {{- $bucket := default (dict) .Values.global.bucket -}}
+  {{- $hasCustomerBucket := not (empty $bucket.name) -}}
+  {{- $defaultBucket := default (dict) .Values.global.defaultBucket -}}
+  {{- $usesDeploymentIdentity := or
+  (and (not $hasCustomerBucket) (eq $defaultBucket.provider "az"))
+  (and $hasCustomerBucket (eq $bucket.azureAuthMethod "workloadIdentity"))
+  -}}
+{{- and $globalConfigured $usesDeploymentIdentity -}}
+{{- end -}}
+
+{{- define "bufstream.serviceAccountName" -}}
+{{- if include "bufstream.azureStorageServiceAccountEnabled" . | trim | eq "true" -}}
+  {{- $identity := default (dict) .Values.global.azureStorageIdentity -}}
+  {{- $serviceAccount := default (dict) $identity.serviceAccount -}}
+{{ default "wandb-bucket-access" $serviceAccount.name }}
+{{- else -}}
+{{ .Values.bufstream.serviceAccount.name }}
+{{- end -}}
+{{- end -}}
+
 {{/*
 Helpers to generate application configurations from a base, allowing arbitrary overrides from a value
 */}}

charts/operator-wandb/charts/bufstream/templates/cluster-role-bind.yaml

@@ -8,7 +8,7 @@ metadata:
     {{- include "bufstream.labels" . | nindent 4 }}
 subjects:
 - kind: ServiceAccount
-  name: {{ .Values.bufstream.serviceAccount.name }}
+  name: {{ include "bufstream.serviceAccountName" . }}
   namespace: {{ include "bufstream.namespace" . }}
 roleRef:
   kind: ClusterRole