From 3609c15de3b532804434c465d80f2694406c8e47 Mon Sep 17 00:00:00 2001
From: sai pranav <rajasaipranav0@gmail.com>
Date: Fri, 21 Aug 2026 23:30:28 +0530
Subject: [PATCH] Remove Azure Bucket public access from the docs and the code

None of the Bucket providers work without authentication, and the Azure
anonymous path was unreachable in any case: azureauth.NewTokenCredential never
returns nil, so the chain was never empty, chainCredentialWithSecret could not
return the documented nil, and azblob.NewClientWithNoCredential was dead code.

Drop the claim that a bucket with no credential chain is assumed to be publicly
reachable, the azure-public example that relied on it, and the note saying
publicly accessible storage needs neither secretRef nor serviceAccountName.
Remove the unreachable fallback and the dead nil return so the code says the
same thing as the docs.

Refs #2136

Signed-off-by: sai pranav <rajasaipranav0@gmail.com>
---
 docs/spec/v1/buckets.md       | 23 +----------------------
 internal/bucket/azure/blob.go | 16 ++++------------
 2 files changed, 5 insertions(+), 34 deletions(-)

diff --git a/docs/spec/v1/buckets.md b/docs/spec/v1/buckets.md
index eb02f5114..9f431d3c4 100644
--- a/docs/spec/v1/buckets.md
+++ b/docs/spec/v1/buckets.md
@@ -339,8 +339,7 @@ with:
   with the `AZURE_CLIENT_ID`
 - Managed Identity with a system-assigned identity
 
-is attempted by default. If no chain can be established, the bucket
-is assumed to be publicly reachable.
+is attempted by default.
 
 When a reference is specified, it expects a Secret with one of the following
 sets of `.data` fields:
@@ -359,23 +358,6 @@ For any Managed Identity and/or Microsoft Entra ID (Formerly Azure Active Direct
 the base URL can be configured using `.data.authorityHost`. If not supplied,
 [`AzurePublicCloud` is assumed](https://pkg.go.dev/github.com/Azure/azure-sdk-for-go/sdk/azidentity#AuthorityHost).
 
-##### Azure example
-
-```yaml
----
-apiVersion: source.toolkit.fluxcd.io/v1
-kind: Bucket
-metadata:
-  name: azure-public
-  namespace: default
-spec:
-  interval: 5m0s
-  provider: azure
-  bucketName: podinfo
-  endpoint: https://podinfoaccount.blob.core.windows.net
-  timeout: 30s
-```
-
 ##### Azure Service Principal Secret example
 
 ```yaml
@@ -1004,9 +986,6 @@ the `.spec.provider` field:
   feature gate `ObjectLevelWorkloadIdentity` must be enabled, otherwise the
   controller will error out.
 
-**Note:** that for a publicly accessible object storage, you don't need to
-provide a `secretRef` nor `serviceAccountName`.
-
 **Important:** `.spec.secretRef` and `.spec.serviceAccountName` are mutually
 exclusive and cannot be set at the same time. This constraint is enforced
 at the CRD level.
diff --git a/internal/bucket/azure/blob.go b/internal/bucket/azure/blob.go
index 94489add9..b4e21ac99 100644
--- a/internal/bucket/azure/blob.go
+++ b/internal/bucket/azure/blob.go
@@ -207,13 +207,8 @@ func NewClient(ctx context.Context, obj *sourcev1.Bucket, opts ...Option) (c *Bl
 		err = fmt.Errorf("failed to create environment credential chain: %w", err)
 		return nil, err
 	}
-	if token != nil {
-		c.Client, err = azblob.NewClient(obj.Spec.Endpoint, token, clientOpts)
-		return
-	}
 
-	// Fallback to simple client.
-	c.Client, err = azblob.NewClientWithNoCredential(obj.Spec.Endpoint, clientOpts)
+	c.Client, err = azblob.NewClient(obj.Spec.Endpoint, token, clientOpts)
 	return
 }
 
@@ -501,7 +496,8 @@ func sasTokenFromSecret(ep string, secret *corev1.Secret) (string, error) {
 //     environment variable, if found.
 //   - azidentity.ManagedIdentityCredential with defaults.
 //
-// If no valid token is created, it returns nil.
+// The chain always contains at least one credential, so this never returns a nil
+// TokenCredential; Azure buckets are not supported without authentication.
 func chainCredentialWithSecret(ctx context.Context, secret *corev1.Secret, opts ...auth.Option) (azcore.TokenCredential, error) {
 	var creds []azcore.TokenCredential
 
@@ -519,11 +515,7 @@ func chainCredentialWithSecret(ctx context.Context, secret *corev1.Secret, opts
 		creds = append(creds, token)
 	}
 
-	if len(creds) > 0 {
-		return azidentity.NewChainedTokenCredential(creds, nil)
-	}
-
-	return nil, nil
+	return azidentity.NewChainedTokenCredential(creds, nil)
 }
 
 // extractAccountNameFromEndpoint extracts the Azure account name from the