Is your feature request related to a problem or challenge? Please describe what you are trying to do.
Reported by @emilk on #781:
AzureClient::signer() calls get_user_delegation_key() — a GetUserDelegationKey network round-trip (POST /?restype=service&comp=userdelegationkey) — on every signed_url / signed_urls call. A user delegation key is reusable until its expiry, so re-fetching it per request is wasteful and, under load, gets throttled by Azure (HTTP 503 ServerBusy).
Notably the other backends do not make an uncached network call while signing: the AWS signer signs locally from its cached credential, and GCP caches its signing credentials. Azure is the outlier — it makes a GetUserDelegationKey call on top of the already-cached AAD token.
We hit this in production: a workload issuing many presigned-URL requests against Azure Blob drove ~100k GetUserDelegationKey POSTs in 2h (~840/min), ~35% of which returned 503. The retry client backed off 10× (~10s) and then surfaced the error to the caller.
Describe the solution you'd like
Describe alternatives you've considered
Additional context
Is your feature request related to a problem or challenge? Please describe what you are trying to do.
Reported by @emilk on #781:
AzureClient::signer()callsget_user_delegation_key()— aGetUserDelegationKeynetwork round-trip (POST /?restype=service&comp=userdelegationkey) — on everysigned_url/signed_urlscall. A user delegation key is reusable until its expiry, so re-fetching it per request is wasteful and, under load, gets throttled by Azure (HTTP 503ServerBusy).Notably the other backends do not make an uncached network call while signing: the AWS signer signs locally from its cached credential, and GCP caches its signing credentials. Azure is the outlier — it makes a
GetUserDelegationKeycall on top of the already-cached AAD token.We hit this in production: a workload issuing many presigned-URL requests against Azure Blob drove ~100k
GetUserDelegationKeyPOSTs in 2h (~840/min), ~35% of which returned 503. The retry client backed off 10× (~10s) and then surfaced the error to the caller.Describe the solution you'd like
Describe alternatives you've considered
Additional context