fix(azure): create Pulumi state storage accounts as StorageV2

[amdove]

Summary

The bootstrap step created the Pulumi state storage account with the legacy BlobStorage account kind. This switches new accounts to StorageV2, the current general-purpose kind.

StorageV2 is a superset of BlobStorage. Pulumi state access (block blobs via the azblob:// backend) is functionally identical. The legacy BlobStorage kind lacks some newer security/network properties that customer security baselines (Azure Policy) evaluate against, so StorageV2 is the cleaner compliance baseline.

Scope / impact

• New workloads only. CreateStorageAccount is guarded by an existence check in bootstrap, so this does not touch existing accounts.
• Existing accounts can be upgraded in place, no downtime, via:

  az storage account update --name <acct> --resource-group <rg> --set kind=StorageV2

  (in-place metadata change — keeps name, endpoints, keys, data; one-way.)

Testing

• go build ./..., go vet ./azure/... pass
• Pre-commit hooks (lib) pass

🤖 Generated with Claude Code

[stevenolen]

thank you!

[amdove]

@claude review please

[claude]

Claude finished @amdove's task in 38s —— View job

---

Code Review

• Read changed file and diff
• Review code for correctness, security, and best practices
• Post findings

---

lib/azure/blobstorage.go — single-line kind change (KindBlobStorage → KindStorageV2).

The change is correct. A few notes:

Correctness: StorageV2 is a superset of BlobStorage. Block blob access (which azblob:// uses for Pulumi state) is fully supported, and AccessTier: Cool is valid on StorageV2 accounts. No functional regression.

Scope guard: The PR description correctly notes that CreateStorageAccount is only called after an existence check in bootstrap, so existing accounts are unaffected. Worth confirming — StorageAccountExists returns true when the account already exists, and callers skip CreateStorageAccount in that case. That logic is not in this file, but the claim holds as long as callers respect it.

Comment: The added comment (lines 32–35) is well-motivated — it explains why the legacy kind was a problem and confirms azblob:// compatibility. Reasonable to keep given the non-obvious compliance angle.

Minor: No blank line between CreateStorageAccount and BlobContainerExists at line 53/54 — pre-existing style issue, not introduced here.

Overall: change is small, well-scoped, and correctly reasoned. No issues.