You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
| Logging, moderate I/O | Premium_LRS | 1–2 ms | Up to 100,000 |
29
-
| Media/content, high throughput | Premium_ZRS | 1–2 ms | Up to 100,000 |
25
+
| Workload type | File share type | Storage account kind | Storage account SKU |
26
+
|-|-|-|-|
27
+
| Logging, moderate I/O | SSD provisioned v2 with Local redundancy |`FileStorage`|`PremiumV2_LRS`|
28
+
| Media/content, high throughput | SSD provisioned v2 with Zone redundancy |`FileStorage`|`PremiumV2_ZRS`|
29
+
| Config files, low I/O | SSD provisioned v2, HDD provisioned v2, or HDD pay-as-you-go with Local redundancy |`FileStorage` (provisioned v2) or `StorageV2` (pay-as-you-go) |`PremiumV2_LRS`, `StandardV2_LRS`, `Standard_LRS`|
30
+
31
+
For complete scalability and performance information, see [Scalability and performance targets for Azure Files](storage-files-scale-targets.md).
30
32
31
33
Deploy the storage account in the same Azure region as your AKS cluster to minimize network latency.
32
34
@@ -40,17 +42,19 @@ Azure Files integrates with Kubernetes through the Container Storage Interface (
40
42
41
43
### SSD file shares for optimal performance
42
44
43
-
Azure Files storage tiers:
45
+
Azure Files has two media tiers. For new deployments, SSD provisioned v2 is recommended for most workloads:
46
+
47
+
-**SSD** (recommended): Suitable for logging, media serving, databases, and latency-sensitive workloads. Available with the provisioned v2 billing model (recommended, `PremiumV2_LRS` / `PremiumV2_ZRS`) or the legacy provisioned v1 billing model (`Premium_LRS` / `Premium_ZRS`). Up to 102,400 IOPS and 10,340 MiB/sec throughput per share.
48
+
-**HDD**: Suitable for config files and infrequent access. Available with the provisioned v2 billing model (`StandardV2_LRS` / `StandardV2_ZRS`) or the pay-as-you-go billing model (`Standard_LRS` / `Standard_ZRS`). Up to 50,000 IOPS and 5,120 MiB/sec throughput per share with provisioned v2. For very small shares, HDD pay-as-you-go (`Standard_LRS` / `Standard_ZRS`) may be more cost-effective because HDD provisioned v2 requires a minimum amount of provisioned IOPS and throughput with no free baseline. For most other HDD workloads, SSD provisioned v2 is actually more cost-effective at small share sizes due to its included baseline IOPS and throughput.
44
49
45
-
-**Standard (HDD)**: Up to 1,000 IOPS, 60 MiB/s throughput per share. Use for config files, infrequent access.
46
-
-**Premium (SSD)**: Baseline 400 IOPS + 1 IOPS per GiB provisioned, up to 100,000 IOPS. Use for logging, media serving, databases.
50
+
For complete scalability and performance information, see [Scalability and performance targets for Azure Files](storage-files-scale-targets.md).
47
51
48
52
Deploy file shares in the same region as your AKS cluster. Cross-region mounts add 50–100+ ms latency.
49
53
50
54
### Protocol support
51
55
52
56
-**SMB 3.x**: Linux and Windows nodes. Requires port 445 outbound. Supports storage account key or Microsoft Entra ID authentication.
53
-
-**NFS 4.1**: Linux nodes only. Requires Premium SKU and virtual network-enabled storage account. No authentication; relies on network security.
57
+
-**NFS 4.1**: Linux nodes only. Requires SSD file shares and a virtual network-enabled storage account. No authentication; relies on network security.
54
58
55
59
### Security and compliance
56
60
@@ -91,6 +95,87 @@ Some common use cases for Azure Files with AKS include:
91
95
-**Batch processing and ETL workloads**: Azure Files enables efficient data sharing between batch processing jobs, ETL pipelines, and data processing workflows where multiple pods need access to input data and output results.
92
96
-**Development and testing environments**: Shared storage for development teams to collaborate on code, share test data, and maintain consistent development environments across different pods and nodes.
Dynamic provisioning automatically creates Azure file shares when you create a persistent volume claim. Verify your environment meets these requirements:
101
+
102
+
| Requirement | Details |
103
+
|-------------|----------|
104
+
|**AKS version**| 1.21 or later |
105
+
|**CSI driver version**| v1.0.0 or later (preinstalled on AKS 1.21+) |
106
+
|**Supported node pools**| Linux: SMB and NFS protocols; Windows: SMB protocol only |
107
+
|**Role assignments**| AKS cluster identity requires Storage Account Contributor role; for private endpoints, also requires Private DNS Zone Contributor |
|**Region constraints**| NFS protocol requires SSD file shares and a virtual network-enabled storage account; ZRS requires availability zone support |
110
+
111
+
With dynamic provisioning, storage is automatically created when a persistent volume claim is created. The Azure Files CSI driver supports dynamic provisioning through Kubernetes storage classes.
112
+
113
+
### Prerequisites for dynamic provisioning
114
+
115
+
Ensure the following are in place before creating a StorageClass for dynamic provisioning:
116
+
117
+
- AKS cluster version 1.21 or later
118
+
- Linux node pool (for NFS) or Linux/Windows node pool (for SMB)
119
+
- AKS cluster identity with **Storage Account Contributor** role on the resource group
120
+
- For NFS: SSD file share (such as `PremiumV2_LRS` or `Premium_LRS`) with virtual network service endpoint enabled
121
+
- For private endpoints: **Private DNS Zone Contributor** role on the private DNS zone
122
+
123
+
### Steps to configure dynamic provisioning
124
+
125
+
1.**Create the StorageClass** – Define the provisioning parameters (SKU, protocol, mount options).
126
+
2.**Create a PersistentVolumeClaim (PVC)** – Reference the StorageClass; the CSI driver auto-creates the Azure file share.
127
+
3.**Deploy your workload** – Mount the PVC in your pod spec.
128
+
4.**Verify** – Confirm PVC is `Bound` and the mount path is accessible.
129
+
130
+
### StorageClass parameters for dynamic provisioning
131
+
132
+
Use these parameters when defining a StorageClass for Azure Files dynamic provisioning:
|`reclaimPolicy`|`Delete` / `Retain`| Action when PVC is deleted |
141
+
|`volumeBindingMode`|`Immediate` / `WaitForFirstConsumer`| When to provision storage |
142
+
143
+
This YAML defines a storage class (Kubernetes provisioning template) for dynamic provisioning of SSD provisioned v2 Azure file shares with the SMB protocol. For Linux mount options, see [SMB mount options reference](#smb-mount-options-reference-linux).
|**Region constraints**| ZRS SKUs require regions with availability zone support |
106
191
107
192
Azure Files is particularly useful for:
@@ -120,7 +205,7 @@ metadata:
120
205
spec:
121
206
accessModes:
122
207
- ReadWriteMany
123
-
storageClassName: azurefile-csi-premium
208
+
storageClassName: azurefile-csi-premiumv2-custom
124
209
resources:
125
210
requests:
126
211
storage: 10Gi
@@ -173,7 +258,7 @@ Before deploying centralized logging storage, verify your environment meets thes
173
258
|**CSI driver version**| v1.0.0 or later (preinstalled on AKS 1.21+) |
174
259
|**Supported node pools**| Linux (recommended for DaemonSet log collectors); Windows supported with SMB protocol |
175
260
|**Role assignments**| Storage Account Contributor or Storage File Data SMB Share Contributor on the storage account |
176
-
|**SKU options**|Premium_LRS or Premium_ZRS recommended for high-throughput logging |
261
+
|**SKU options**|`PremiumV2_LRS` or `PremiumV2_ZRS` recommended for high-throughput logging (SSD provisioned v2); `Premium_LRS` or `Premium_ZRS` also supported (SSD provisioned v1)|
177
262
|**Region constraints**| Deploy storage account in the same region as AKS cluster for optimal latency |
178
263
179
264
Azure Files can serve as a central repository for application logs, enabling log aggregation from multiple pods and providing persistent storage for log analysis tools.
Dynamic provisioning automatically creates Azure file shares when you create a persistent volume claim. Verify your environment meets these requirements:
246
-
247
-
| Requirement | Details |
248
-
|-------------|----------|
249
-
|**AKS version**| 1.21 or later |
250
-
|**CSI driver version**| v1.0.0 or later (preinstalled on AKS 1.21+) |
251
-
|**Supported node pools**| Linux: SMB and NFS protocols; Windows: SMB protocol only |
252
-
|**Role assignments**| AKS cluster identity requires Storage Account Contributor role; for private endpoints, also requires Private DNS Zone Contributor |
253
-
|**SKU options**| Standard: Standard_LRS (locally redundant), Standard_GRS (geo-redundant, includes read access as RA-GRS), Standard_ZRS (zone-redundant), Standard_GZRS (geo-zone-redundant, includes read access as RA-GZRS); Premium: Premium_LRS, Premium_ZRS |
254
-
|**Region constraints**| NFS protocol requires premium file shares and a virtual network-enabled storage account; ZRS requires availability zone support |
255
-
256
-
With dynamic provisioning, storage is automatically created when a persistent volume claim is created. The Azure Files CSI driver supports dynamic provisioning through Kubernetes storage classes.
257
-
258
-
### Prerequisites for dynamic provisioning
259
-
260
-
Ensure the following are in place before creating a StorageClass for dynamic provisioning:
261
-
262
-
- AKS cluster version 1.21 or later
263
-
- Linux node pool (for NFS) or Linux/Windows node pool (for SMB)
264
-
- AKS cluster identity with **Storage Account Contributor** role on the resource group
265
-
- For NFS: Premium SKU storage account with virtual network service endpoint enabled
266
-
- For private endpoints: **Private DNS Zone Contributor** role on the private DNS zone
267
-
268
-
### Steps to configure dynamic provisioning
269
-
270
-
1.**Create the StorageClass** – Define the provisioning parameters (SKU, protocol, mount options).
271
-
2.**Create a PersistentVolumeClaim (PVC)** – Reference the StorageClass; the CSI driver auto-creates the Azure file share.
272
-
3.**Deploy your workload** – Mount the PVC in your pod spec.
273
-
4.**Verify** – Confirm PVC is `Bound` and the mount path is accessible.
274
-
275
-
### StorageClass parameters for dynamic provisioning
276
-
277
-
Use these parameters when defining a StorageClass for Azure Files dynamic provisioning:
|`reclaimPolicy`|`Delete` / `Retain`| Action when PVC is deleted |
286
-
|`volumeBindingMode`|`Immediate` / `WaitForFirstConsumer`| When to provision storage |
287
-
288
-
This YAML defines a storage class (Kubernetes provisioning template) for dynamic provisioning of SSD (premium) Azure file shares with SMB protocol. For Linux mount options, see [SMB mount options reference](#smb-mount-options-reference-linux).
289
-
290
-
```yaml
291
-
apiVersion: storage.k8s.io/v1
292
-
kind: StorageClass
293
-
metadata:
294
-
name: azurefile-csi-premium
295
-
provisioner: file.csi.azure.com
296
-
parameters:
297
-
skuName: Premium_LRS
298
-
protocol: smb
299
-
allowVolumeExpansion: true
300
-
mountOptions:
301
-
# Canonical permissions: 0755/uid=1000/gid=1000 for least privilege.
302
-
# Use 0777/uid=0/gid=0 only if app requires root or broad write access.
303
-
- dir_mode=0755
304
-
- file_mode=0755
305
-
- uid=1000
306
-
- gid=1000
307
-
- mfsymlinks
308
-
- cache=strict
309
-
- actimeo=30
310
-
```
311
-
312
-
**Verify StorageClass:**
313
-
314
-
```bash
315
-
# Check StorageClass exists
316
-
kubectl get sc azurefile-csi-premium -o jsonpath="{.provisioner}"
317
-
# Expected: file.csi.azure.com
318
-
319
-
# Test dynamic provisioning with a PVC (replace with your PVC name)
320
-
kubectl get pvc <YOUR_PVC_NAME, e.g., my-azurefile-pvc> -o jsonpath="{.status.phase}"
321
-
# Expected: Bound (after creating a PVC referencing this StorageClass)
322
-
```
323
-
324
328
## Static provisioning: use existing Azure file shares
325
329
326
330
Static provisioning connects to preexisting Azure file shares. Verify your environment meets these requirements:
@@ -344,7 +348,7 @@ Ensure the following are in place before creating a PersistentVolume for static
344
348
- Linux node pool (for NFS) or Linux/Windows node pool (for SMB)
345
349
- Preexisting Azure storage account and file share
346
350
- For SMB: Kubernetes Secret containing `azurestorageaccountname` and `azurestorageaccountkey`
347
-
- For NFS: Storage account with Premium SKU and virtual network service endpoint; no secret required
351
+
- For NFS: Storage account with SSD file shares (such as `PremiumV2_LRS` or `Premium_LRS`) and virtual network service endpoint; no secret required
348
352
- Network connectivity from AKS nodes to the storage account (public endpoint, service endpoint, or private endpoint)
349
353
350
354
### Steps to configure static provisioning
@@ -471,17 +475,17 @@ Ensure the following are in place before configuring private endpoints for Azure
471
475
5. **Deploy your workload** – Mount the PVC in your pod spec.
472
476
6. **Verify** – Confirm the PVC binds and that DNS resolves to a private IP (`nslookup <storageaccount>.file.core.windows.net`).
473
477
474
-
This YAML example demonstrates how to create Azure file storage with private endpoint configuration for enhanced security. For Linux mount options, see [SMB mount options reference](#smb-mount-options-reference-linux).
478
+
This YAML example demonstrates how to create Azure file storage with private endpoint configuration for enhanced security. The CSI driver automatically discovers the virtual network from the AKS cluster configuration, so `vnetResourceGroup`, `vnetName`, and `subnetName` are optional if the virtual network is in the same resource group as the AKS cluster. Specify them explicitly for cross-resource-group or multi-VNet scenarios. For Linux mount options, see [SMB mount options reference](#smb-mount-options-reference-linux).
0 commit comments