From 586f219d4901afd661833b4ae5484a24f62a42f4 Mon Sep 17 00:00:00 2001
From: Stephen Mkandawire <stephen.mkandawire@microsoft.com>
Date: Thu, 7 Mar 2024 13:10:36 +0000
Subject: [PATCH] Ensure azure cloud config can be loaded from secret

Manually pickup fixes from upstream:
- ensures azure cloud config can be loaded from secret
- fix goveralls
---
 .github/workflows/linux.yaml                  |  15 +-
 BLOB_CSI_VERSION                              |   2 +-
 charts/index.yaml                             |  11 +-
 charts/v4.7.0/blob-csi-driver-v4.7.0.tgz      | Bin 0 -> 5872 bytes
 charts/v4.7.0/blob-csi-driver/Chart.yaml      |   5 +
 .../blob-csi-driver/templates/NOTES.txt       |   5 +
 .../blob-csi-driver/templates/_helpers.tpl    |  49 +++
 .../templates/csi-blob-controller.yaml        | 224 +++++++++++++
 .../templates/csi-blob-driver.yaml            |  14 +
 .../templates/csi-blob-node.yaml              | 296 ++++++++++++++++++
 .../templates/rbac-csi-blob-controller.yaml   | 121 +++++++
 .../templates/rbac-csi-blob-node.yaml         |  44 +++
 .../serviceaccount-csi-blob-controller.yaml   |  17 +
 .../serviceaccount-csi-blob-node.yaml         |  17 +
 charts/v4.7.0/blob-csi-driver/values.yaml     | 173 ++++++++++
 pkg/blob/azure.go                             |   2 +-
 16 files changed, 985 insertions(+), 10 deletions(-)
 create mode 100644 charts/v4.7.0/blob-csi-driver-v4.7.0.tgz
 create mode 100644 charts/v4.7.0/blob-csi-driver/Chart.yaml
 create mode 100644 charts/v4.7.0/blob-csi-driver/templates/NOTES.txt
 create mode 100644 charts/v4.7.0/blob-csi-driver/templates/_helpers.tpl
 create mode 100644 charts/v4.7.0/blob-csi-driver/templates/csi-blob-controller.yaml
 create mode 100644 charts/v4.7.0/blob-csi-driver/templates/csi-blob-driver.yaml
 create mode 100644 charts/v4.7.0/blob-csi-driver/templates/csi-blob-node.yaml
 create mode 100644 charts/v4.7.0/blob-csi-driver/templates/rbac-csi-blob-controller.yaml
 create mode 100644 charts/v4.7.0/blob-csi-driver/templates/rbac-csi-blob-node.yaml
 create mode 100644 charts/v4.7.0/blob-csi-driver/templates/serviceaccount-csi-blob-controller.yaml
 create mode 100644 charts/v4.7.0/blob-csi-driver/templates/serviceaccount-csi-blob-node.yaml
 create mode 100644 charts/v4.7.0/blob-csi-driver/values.yaml

diff --git a/.github/workflows/linux.yaml b/.github/workflows/linux.yaml
index 80cbaf9b4..d8b6bc40e 100644
--- a/.github/workflows/linux.yaml
+++ b/.github/workflows/linux.yaml
@@ -10,7 +10,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
     - name: Set up Go 1.x
-      uses: actions/setup-go@v4
+      uses: actions/setup-go@v5
       with:
         go-version: ^1.16
       id: go
@@ -25,7 +25,7 @@ jobs:
         sudo dpkg -i packages-microsoft-prod.deb
         sudo apt-get update
         sudo apt-get install blobfuse
-        go test -covermode=count -coverprofile=profile.cov ./pkg/...
+        go test -race -covermode=atomic -coverprofile=profile.cov ./pkg/...
 
     - name: Run build test
       run: |
@@ -42,9 +42,10 @@ jobs:
         export PATH=$PATH:$HOME/.local/bin
         make blobfuse-proxy
 
-    - name: Get code coverage
+    - name: Install goveralls
+      run: go install github.com/mattn/goveralls@latest
+
+    - name: Send coverage
       env:
-          COVERALLS_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-      run: |
-        GO111MODULE=off go get github.com/mattn/goveralls
-        $(go env GOPATH)/bin/goveralls -coverprofile=profile.cov -service=github
+        COVERALLS_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+      run: goveralls -coverprofile=profile.cov -service=github
diff --git a/BLOB_CSI_VERSION b/BLOB_CSI_VERSION
index f63f06be9..3ef8c917c 100644
--- a/BLOB_CSI_VERSION
+++ b/BLOB_CSI_VERSION
@@ -1 +1 @@
-BLOB_CSI_VERSION=v4.6.0
+BLOB_CSI_VERSION=v4.7.0
diff --git a/charts/index.yaml b/charts/index.yaml
index 3c13c1a12..b9ccab85f 100644
--- a/charts/index.yaml
+++ b/charts/index.yaml
@@ -370,6 +370,15 @@ entries:
     urls:
     - https://raw.githubusercontent.com/avoltz/blob-csi-driver/staging/charts/v4.6.0/blob-csi-driver-v4.6.0.tgz
     version: v4.6.0
+  - apiVersion: v1
+    appVersion: v4.7.0
+    created: "2024-03-07T20:20:15.553036749Z"
+    description: Azure Blob Storage CSI driver
+    digest: c78b006ff5897b590ed4b27b2f9d8ee8dae23f91e2e885eb5cea09dac9b4195f
+    name: blob-csi-driver
+    urls:
+    - https://raw.githubusercontent.com/avoltz/blob-csi-driver/staging/charts/v4.7.0/blob-csi-driver-v4.7.0.tgz
+    version: v4.7.0
   - apiVersion: v1
     appVersion: latest
     created: "2023-12-01T09:01:28.976577418Z"
@@ -379,4 +388,4 @@ entries:
     urls:
     - https://raw.githubusercontent.com/avoltz/blob-csi-driver/staging/charts/latest/blob-csi-driver-v0.0.0.tgz
     version: v0.0.0
-generated: "2023-12-01T09:01:29.975686234Z"
+generated: "2024-03-07T20:20:15.553036749Z"
diff --git a/charts/v4.7.0/blob-csi-driver-v4.7.0.tgz b/charts/v4.7.0/blob-csi-driver-v4.7.0.tgz
new file mode 100644
index 0000000000000000000000000000000000000000..5adb6356d19f59c6913ad8eee654c1f73e178b5e
GIT binary patch
literal 5872
zcmV<M77ytkiwG0|00000|0w_~VMtOiV@ORlOnEsqVl!4SWK%V1T2nbTPgYhoO;>Dc
zVQyr3R8em|NM&qo0PH<&bK5r3{j6VsQF_zfJ)z$GlAdP#!M2oC6I<3uPI~urIvR*v
zNjQ@L3xJAM*Z=()0HpXLQg4=(TpuwXVv&p81-QFd>@L8O%SM(hh~;oH175wJVlFFl
z?783V?W)ykwe!<c{eP`i%l==hpPzhJKRtWbI5{~xc~|?cRzIzupM8gF`(vT_3WUV`
zyV{FsWjps@a$%o*1}+GrO*E^Qu<tK^x>$mcB?pAfi7)lN%Rd4R=*ndyG?0wr383pi
z2N~fhQS3nzWkjkpTi`#fysOkoU%Si4D{*D@e}>%v#C{FHYW=U*&d=Uu_5bwb^r-)b
zxQK@*&@3S|!UFo>vnKLvUh#;{nP6jCv6-iyx@@GN5aQr7K_uhzCaOOCB&xO`)kumo
zgv67D@le10z;%1fCHB0DI^!;rJq`k>dT0yM<7`HheE^<AfC*832u8puNDzvIqG$PW
zqnPCEq;giNtt07@8Bh?S$Jq!rqZl>uRg(n0Mx|a`PmnSPT3WgKFd;&6yhTS<<4`p%
z9yL#~@Y8w@Y(e@U$RFE`FgFbnr0VNQm28&<PB=^Sf{{z?Yjvkodh-VLVGJCo4M;M?
zC?Lj>$2cGXHU}xx?Gd0rfP=nFfod{@PLLK+p-^xbH_=o|Uo@);rYnS19cGKF#Nt6z
zZAQmr5^%75=2$kP5)%r%s_<DFndNgb!xEw)omWfxelKv{f#If!e*LZV23g3=Y2G}1
zdGn7jHy~Z?L8&Bw&xj3|w#@=6)%e;Ru!JU(JOK0t{i3>}{(g%>ScDC*KwpUKsy>@0
z4jMC#<}9e70Z26*W9$k*WUOwYFPQ3^fdKWJBld+>6g@^IXRZspsou0@ba8Rh5*WQf
zidn?QXb`dx@*9qMM4xdz{Gre$&}lK;0a1yMu$>(gg?`~EXwkS<oZ8C6P^dAbOk(v*
z%LH~D{h#Y1IR)f1N0fZ#T*gpM^z^)p#>FFWS7Er(0H!grEOZ?R$-GQELM1~UNbF#V
zOST3{G(_kPdiY6L*!PzmAH~xR%s{(I81*<|oXGjLi-pDyR48vszf8px5&@r)86XaV
z1>6QCri{x?rQc@M24BVsphu^wl)w*3TRsQyv@cgJ`AL4d`i+RWkl<Oi8wd&9vN@5&
z#;&4106S37THfGMqKV>EjVJSc#$`a&L&*>iC|W2T!U9o7Ib#xy=172)N~N(<dX4Vd
zU{e%Ea|Dmr^Ibqq^*aO7L{AF$rT8S2sMl+?I(jZG13i~Y36)p~TaIcdxm4!qT8~$(
z)lGzz0kiZ&GuJr9(89+yG?98CmKnbiQnJRrv^`&q?xM{?{HILFF32y8KP>EooD#7Z
zADacPqZG;^0*_p9lo5y-M-Brut`a%m19cFi=yuSFnwOB0SWaxwV_Y^-<Dcgzr}<Og
z6tF9&F<7Idrw5nVSTvFT70^3+i<LYyjX{cTUK@UTE~XGaa@j=5yxT-)8kdn|VaVmp
z_lhr%ND=)~%zJunI;+)gNqCpT?*WJ;l<fyf3cRIeji^;le~XFLUq~$Wkcw$EUPvQ5
zk-yf^;qjO#bq-COvi<{5rj_yVmSisQ(E4gD7J7hr6P5K$!I=w{w1x7t1eHUI%vY@y
zwsQNC2q~fmFdl;~o2cAn1A7Wi;6iyL{GoFAN*G_AiuD3AB|Wt+n<aJos~IHyv_oA&
z;WKjs4?e>D(zZc}Ux=J`9H3H*L!{&$e*8r73=>ybrzWazW?fE}>;q7R;L2sAaUh__
z*<*srD0N$7BveT3x>18g2V&qw_@Z2|oL0`tdCeL*?HX~zMx|CcF%1RCTl{$E1AR|i
z=muV*rI&e7{-;^`nU<mD{^UDYLhEYLE~0mh?J4xIoHkL_({4KUl`X#~9t<S*{0`M1
zEt0Uip7OPNz&#>_@qB9U-o0D4vj??&g$taoY;0dfWG5S#V+u-Rz%t<aEsVtn&H_JL
zJM{rOzi=Yqj@qCU?fu|>?!!VYK7cgZIFMMaNQ@MejCa{gxzQC{kcu`E;ey?Gs>)Tm
zoB&luNQq?-{T>A4F?npF^4(xyO~LilQ{Dap8?-*&ER?idMsLtU(~$`esoOtNrgT~S
z{Vi&>uReWvi#px+cW==zm;G+1`{6BW_xpE!<?JYrHPmd)gt`&`F1dsTkE%DyV7VZh
zs5-;E>XK14yi?NJBsps$2Sx<bQc1Z^F2l~kG-+c<fXYrQB=ZLS%Cx78-QQ4WtX<X1
z%a&3z<=&WOf?lU^3kyLe6ddGXiYLn53h^Rh{47Fsd!bf85~x~=VWDq@zOp7L)ml%e
zwVMX%w9pqKry6WKsv(I^ONm*COLuGU@t<t`PlD&`*iE&2ci$dV<fD8sjdk(=lk-L<
z{&#l%u6B(79pbuITCpmquQXs1E=wHnT{Z{3n%1k<Q1~mQ(mg}=6zqpJ$jmZVVi}0H
z$aet?P>YFXDb#;ky2!F<<i%V(J)ue;G+brj+o0!X#gaj0St2yc7iDfBms+9c=Q6Ua
zFId{sWBMU=73=?S3a$@aRHXmHRKObjZ=9T;X7vC3?3n*M%=PqC{Rf&6uc_y)F>yi8
zeYo({u-H>*qJLDMpGzeT)_(Lcb@X&b!!V$p0d>k)!#zD&$bm7TfXdn}QE+8s#gA~{
zN>njfX04i)&nDxfAn#_tIdK5}sk~)sqw^E}C-IEGg34Bm45*|3*1VOjb%4?EVz^VR
zhN(w2SL?X)XdZKH0)3TIKI0lBCgyWO<rtO!Cak}Sa=HWN?{N8m{?zdkWu?mhQ%2=s
zd6&*G&tuAyFosPOF&P1vfTY2OeLu5kHD2P=6N+>@^=>LCw~<~kQQI`k8q;EyP4Kjc
zUpK+0dPu1422N3L3OKWw=QFB(+C;2%8P3OCT5P;^&qHU-8qL#vk0Ra?@8jsrUoLXy
z`3M*JZ-s5C$)D)=fXURTK0lX~OI{Jvsush%E`;(~NwO1aQZh(w9wW*AjXie-#DZ|@
z%^J1$1J_+7X~vAl(OrS^-?Ja*Q4%jZ<}jOVQG}NgFuD=PbOI~ep+$~H4R1kj(jEKS
zHuqb)is%2FfccJP0juZ#M(zA8<NvFrd*e9&AL4o-)M=uYcI-W%vXm?c!oDx6vwA7Y
zf5kBerE8HfiN%A4(}RHu<B&xzd<liKg$bVM4B9%h2rW+=?qa(56H!9d5*nQ<aN&c_
zJ;wQreDu+CLn4}mnqiDj+S8i^n;SEl$LjJ77qfhB8b<mTl1~i0j&-Ft*@Bl%2kxh(
zCb8Ad##|~<z$Mwn#GoS3N)*wk>R@eI@?a4*H~2&ATtIS>rHw3jW+IE9ujoQz0!X7y
zq>$q_iR^PTXX?x}`x7OpW;$d9P~FsFpq!T!1sN0Mqp)L=_G&Uqqn1BSsw;1j&GvAq
zb((m=t4pOc^CdC?61Q`xh{B=QCYbP^a3Oyoa{9A@4*}DK7Tv5BN<U7JjY*|KxC;qM
z`)W)ykq$@}No3M)#F^2A#H~(%g|W%hAQp>%mRK_5x&g^lwyJ>gD(OrPSjLfDCy_a|
z1&Non^fc)ON3T1b*I%$Mz*Z}O9%pK?8sA4qEnJ(ZA5cj=Xqlzv%Kjw+_%Y#BRDX*e
z$4+s~la)yFB}>-A*F43d$3ZUztL3!*RnnRAN?fv)v~Hn7H&Hn;xTbwn&WE0#m!7S{
z-CPGP@dQ0Tm(2jU0ygAle>Bq*211xmL{bdYu$QgbMWeiQQ#-oYaX1KZ@%@jNtyaH1
z82mj4&;{%Ow;-%1S`V>7%rXawl2jJRi+ZCbavsB@<k&K`Q&!{)T%;$_1+dQdVxL&Q
z`{LrPwhCeta3L@1wG<H0S#}tW^oGNfdWK9UsEMj!!C*x&`ynd`y+onlx_2BG6{cVB
zOlQDub-`SgKa&nMIn=27G`<Y?iZ76sLwMqGoGwK<UPa0`3;{FjCj5<hBgt?yXi)~%
zGDV{sXnZPXyI+N0fqGf@(!e{a`@Se{qU>q4E)qxsso%yz?M}oJfGJt9e8%NPz8jO~
zHZF0<8JU&xpT@I`_^%LfbroyJ4&tBUcCGa5%FYdBUav#;D(cG^m*q{v>?qi~;ooe|
zvSvjh7pCL$ClR2I&j^(l-~V_$=nUK4R`0IUz0aH0!m_}HveYX2Uo)R<qKGh`vWXd~
zSDs|t+>I8Xd9$z%KUyXSJ^?CoT4(AP@)5-tETLoSIfybP4+R|Q!YWfYYnf1|mF-qy
zU~<c@w!<8|3LBzd;YH}`Eekwf&QtUX(C3zdWiTuIw<Mtp7uQsDy~I4C#r$j_{>VJ@
zIg`w0ZWG;K_jX|;ExWmtLy!$A=ay8NYmA8-aJZjx5L4zlrnD`-rc(MJKsK|KjA<?y
z0NuB|XM_?-u-gI`&j(;L>WC&fsik1T32yPYo__2DC(OxjT<iw^@27ryc-?Qe+THuk
z<<0PY=cb+K6u#%o%l1{TkH%zji~Wx<@56W*AbKrfsUru+QY*Y1I9;QuMla`CRPvLk
z)5~_Gch?$rFK@TteN4c03YgZ<%q$yu=-Tw<lK%MVs@?Cl@7n{-!Jv0}{mN`;vysb7
za<0ht?E^|4o7HNuM-|TS6tYG)uK7aca#sH$27bQ3?+u2%{@uU+olk$+m?!XNkmgRa
zYdGA5!R`6mhP||IeYhJAS|5iucOQl~?a%F-O{p%|?G+3I{2rT1W%^NBSL+NUwjcCd
zP&gEZ!FKm^r+?SIZFldr_V+IDe=b-Sg0vHRRH~Xqq3CGBmH!Av*ALKoCwh@?JlN7P
z+c?wFTtu-++wWTu!d>C>E6#*)t2S_%o#i-S=Z?Db95cCElM>A8IBCUHW}@;K9LDis
zSxq3f{D<sI%o6Y)NY%!c<bjY?9a^zv=8bGWFgq-zl+3POK_&NKZWb;KcZTdeRG5o5
zH)Iz<?j9n1A+61pS(^p{b3=%S2n_yUO)+&`u#5q-2n_^Sz&Ya=x(57*uN$_D#{OH6
zS;VXssGDIlCt#n;pI%_;?HEtX`kHIvr%ag6q`mL;6NgD<v<TO^m-!tx<!uX?oo0@F
zQ@obPWxHIQx7}uT*c&^=v%p$pYo>&CiPlV#syKU<C$ibbxf$#P2d`8Au|fS$=w<GH
zB*?n@|I>Hb`kz|8eysmL$Yohps^mwQn*GYdPo{RUUNRLz*MpAP<F&dNC>{IDl=$pW
zyMv{~_OuVb2ZVzYZ-n!i)1hN_NA)bTaMm&#tP+fcyRa%L2*aY81#ZX~?78j2EpuS8
zp{u9HMM!gwhPu)Ar{Dp{?q6gd!3O$InFB965NJ*P-+ALCyZ`6i+3E58pMzXs{T~L8
z(E;pG{->p5pM`%JggcpyK<~O8NRA~;!mY!~JtTBuHsnSgL3Sf^mXGxFh@-I5B#CgB
z%E6_cewCWR94?O4f?us#Ft=leE$GV-*Yc6GPd{Dz*Xy*xS$K76U?QsWN~M2_-(8FT
zma4^!a_n9Q7ngHJq!qHurMqT_y7F;a0Vi}4o)<yrq%)yxal8EpcA!sUOs!~=4Bi9x
zL^eZU8FSQr^f`nl2jt`s!qYFL*@M1(#k<?POm=84Ot?Wj_nD$FBU}d9wc@SavHWF)
zE?FI$qt0oV^(t*{e7lv2x<7lWN!(h8)gWH4C}9jw(6FN8D=c5NKh}5@2OpP0X_-^`
zqRVEUhpDp^r>v%jx~kq#MNE^y!a`9D1${<bn5bn_CYD_oGi<f5I+xwy`~F?`zTIu*
z#}3PsQ9>nfY)dj*Dn&GyI^Dtj<;~6T>gMk1{ii{0mNPx}T1HbxzEm>Dw&a9L4Y7#G
z@N>IA=-hR8B9=KorjS^+XN`Syt+BRmjlFcPv95Q6_Wkho@?XQdUc0Mve8cXi+nq=*
z9i3B1Q_*`7DQ`16t<K=`>ZU#X)N5Vdw_8^`(aN0blOeV~^sT%hD-f#!-wLFf1xd9B
zX|HRqK(;DU&s40&s1H%fxMe!_SWf%jT~4d@YST(Fg=cor*f<xYk?&f$nt$N#2J)73
z3f6w5ZY_ajNyuxmqXfPN_3foGPS-Ahg$s(sOVhbmAIs^*_dmA!ozLz5u;2bL9Nb-h
z9QH2ne_qCrma!G}e()Ht)T1lci!+$l9OS&;jzm~I=D<Zhs*HKxv7+#76Mu529CTvB
z&gpJGu7vQJ#ADcX^!!})-C#nfs1~Lv@|bv)9Cq9|^+r~sNP_Na19MdISi^sS8h$g+
z?W=k}y&z1sTr7Zewc<)7;7q{A_7p5FWJxUT)`#}><@L|);qBe0?)_>sI+&1QX{qb^
zA%`4v3Ys_<-~agW(^Y%ey=%2~fovY-T{j(UP~xw7evRV(V#F)T`oFzx5}Rx^Fj2V;
zwiu)ZX#z4TcM=jyagmd|%{vvdfKh#vs&-6;#GY>%iFXKJX0_<l)qKoGY5e#I)+L15
zGg?;-CDBLjMjd~ExrOzqyVe&XrxtNQ&CGIHuQofc_hoxJw(`+;+s$#@Q*qo=aokgp
z@B0=_#v7p>Y9l0yu@^WD>yf7?{Nt98jriMTOGw%g+K)hIKK8Z@kdS!cgRSR)Zjs_0
zH?6$Jrj=cDI)~WovTBu`yMpD+#}jNm9e70?UC*qil3W&a8@(8Ly*)Q+L|!Tr7dJLl
zamo?guS6a<?0n-Jb~1636<c){dk3~owXe(ttt?qjg09F1tt)%ai)UCXTfHc}miD68
z>}*(Jj&^5pCk_g%(TfLa7=Ltb7q$u`hpQQT(RPy+Hg)6SNTpI2A3sTpN1^dO?sqxv
zcR60KaTVA9^AWbKy&M9(X8+ImdG`AsjrzO#vHt%cS4P9tORty%=k&qd;pQJxp4(?G
zq&5g>XdK8X<Kz!LBPI3?t=u)BTZaCD1&<Oq#cuM9M17v+?)!&$;F>B_OD%f!mLJhX
zzn06tX-o+x@Yk}x*y9uWbRp0T_(%gxK$hR4vP*>iUw=kK{b9yQ{pF}R9(21M2-+?t
z-o{kT-iAC{>AhQdltT#H#X@Y@&kg$oGoW&ZkqdkC7M1-Xa_hTg3!>bMy>{qD2yMo=
zLugVZ@@VM2F?$)bl4V(?Wo^A8)FE{88cLfv)6^P;q;}u(7mWS`whXn_bY+k#?JvbX
z;x;G$Zn7mwS(`9uwruiVV!tA>STXKJFYi@NZFsiCe}kFbz(nlX%D#v~)qLJ6OK8Vl
z<lEJk8PtPYCnev9woUsH@V|gj$_&KD25GPMNWGE5x0U!-y{Vx%oKXrtYf~WPp-gXT
z4wzGfXrU!qZ4T~Iy_y1U_geoSxClGR`6ep)^z=G$kxkeCFF6EY-S__*XJ^^-KTgk%
z=YJgJTC@H?=tQ7vq`##p;J1>#_r`qkkU4-%3?F%ckouFp^W+Y2B$<ZneZJP;Nn4a!
zM#-WO8<A)NQbe#nsJ}Q1Ce!fF58@R(>euj^i$f9L?ELtZCc~s?e=E~qa-;k~Ccqs1
z{+d(Y@me|mhth(Lw7et}ux9?R*Uq!^|7op${QloTuB8lL+Eb1_flTdKuGLw&LSN&A
zZ+~#m78Y~cvuQRvmnL=i%c^Duy+xeVfUM+V9mf(V-h^WVx0ZAg-P5}7rylL_U+3E1
z{%^k$Tx<W&-ev56<LvDC{r7`hU(No<-sjQsA1(j!I$p=?cpa|;U;h^X0RR7D5ER@1
GqyPXXM4WX1

literal 0
HcmV?d00001

diff --git a/charts/v4.7.0/blob-csi-driver/Chart.yaml b/charts/v4.7.0/blob-csi-driver/Chart.yaml
new file mode 100644
index 000000000..38167e9cf
--- /dev/null
+++ b/charts/v4.7.0/blob-csi-driver/Chart.yaml
@@ -0,0 +1,5 @@
+apiVersion: v1
+appVersion: latest
+description: Azure Blob Storage CSI driver
+name: blob-csi-driver
+version: v4.7.0
diff --git a/charts/v4.7.0/blob-csi-driver/templates/NOTES.txt b/charts/v4.7.0/blob-csi-driver/templates/NOTES.txt
new file mode 100644
index 000000000..9ad135dd4
--- /dev/null
+++ b/charts/v4.7.0/blob-csi-driver/templates/NOTES.txt
@@ -0,0 +1,5 @@
+The Azure Blob Storage CSI driver is getting deployed to your cluster.
+
+To check Azure Blob Storage CSI driver pods status, please run:
+
+  kubectl --namespace={{ .Release.Namespace }} get pods --selector="release={{ .Release.Name }}" --watch
diff --git a/charts/v4.7.0/blob-csi-driver/templates/_helpers.tpl b/charts/v4.7.0/blob-csi-driver/templates/_helpers.tpl
new file mode 100644
index 000000000..d99392f32
--- /dev/null
+++ b/charts/v4.7.0/blob-csi-driver/templates/_helpers.tpl
@@ -0,0 +1,49 @@
+{{/* vim: set filetype=mustache: */}}
+
+{{/* Expand the name of the chart.*/}}
+{{- define "blob.name" -}}
+{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" -}}
+{{- end -}}
+
+{{/*
+Create chart name and version as used by the chart label.
+*/}}
+{{- define "blob.chart" -}}
+{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" -}}
+{{- end -}}
+
+{{/*
+Common selectors.
+*/}}
+{{- define "blob.selectorLabels" -}}
+app.kubernetes.io/name: {{ template "blob.name" . }}
+app.kubernetes.io/instance: {{ .Release.Name }}
+{{- end -}}
+
+{{/*
+Common labels.
+*/}}
+{{- define "blob.labels" -}}
+{{- include "blob.selectorLabels" . }}
+app.kubernetes.io/component: csi-driver
+app.kubernetes.io/part-of: {{ template "blob.name" . }}
+app.kubernetes.io/managed-by: {{ .Release.Service }}
+{{- if .Chart.AppVersion }}
+app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
+{{- end }}
+helm.sh/chart: {{ template "blob.chart" . }}
+{{- if .Values.customLabels }}
+{{ toYaml .Values.customLabels }}
+{{- end }}
+{{- end -}}
+
+
+{{/* pull secrets for containers */}}
+{{- define "blob.pullSecrets" -}}
+{{- if .Values.imagePullSecrets }}
+imagePullSecrets:
+{{- range .Values.imagePullSecrets }}
+  - name: {{ . }}
+{{- end }}
+{{- end }}
+{{- end -}}
\ No newline at end of file
diff --git a/charts/v4.7.0/blob-csi-driver/templates/csi-blob-controller.yaml b/charts/v4.7.0/blob-csi-driver/templates/csi-blob-controller.yaml
new file mode 100644
index 000000000..4d2353357
--- /dev/null
+++ b/charts/v4.7.0/blob-csi-driver/templates/csi-blob-controller.yaml
@@ -0,0 +1,224 @@
+kind: Deployment
+apiVersion: apps/v1
+metadata:
+  name: {{ .Values.controller.name }}
+  namespace: {{ .Release.Namespace }}
+  labels:
+    app: {{ .Values.controller.name }}
+    {{- include "blob.labels" . | nindent 4 }}
+spec:
+  replicas: {{ .Values.controller.replicas }}
+  selector:
+    matchLabels:
+      app: {{ .Values.controller.name }}
+      {{- include "blob.selectorLabels" . | nindent 6 }}
+  template:
+    metadata:
+      labels:
+        app: {{ .Values.controller.name }}
+        {{- include "blob.labels" . | nindent 8 }}
+        {{- if .Values.workloadIdentity.clientID }}
+        azure.workload.identity/use: "true"
+        {{- end }}
+        {{- if .Values.podLabels }}
+{{- toYaml .Values.podLabels | nindent 8 }}
+        {{- end }}
+{{- if .Values.podAnnotations }}
+      annotations:
+{{ toYaml .Values.podAnnotations | indent 8 }}
+{{- end }}
+    spec:
+{{- with .Values.controller.affinity }}
+      affinity:
+{{ toYaml . | indent 8 }}
+{{- end }}
+      {{- if .Values.imagePullSecrets }}
+      imagePullSecrets:
+{{ toYaml .Values.imagePullSecrets | indent 8 }}
+      {{- end }}
+      hostNetwork: {{ .Values.controller.hostNetwork }}
+      dnsPolicy: ClusterFirstWithHostNet
+      serviceAccountName: {{ .Values.serviceAccount.controller }}
+      nodeSelector:
+        kubernetes.io/os: linux
+        {{- if .Values.controller.runOnMaster}}
+        node-role.kubernetes.io/master: ""
+        {{- end}}
+        {{- if .Values.controller.runOnControlPlane}}
+        node-role.kubernetes.io/control-plane: ""
+        {{- end}}
+{{- with .Values.controller.nodeSelector }}
+{{ toYaml . | indent 8 }}
+{{- end }}
+      priorityClassName: {{ .Values.priorityClassName | quote }}
+      securityContext:
+        seccompProfile:
+          type: RuntimeDefault
+{{- with .Values.controller.tolerations }}
+      tolerations:
+{{ toYaml . | indent 8 }}
+{{- end }}
+      containers:
+        - name: csi-provisioner
+{{- if hasPrefix "/" .Values.image.csiProvisioner.repository }}
+          image: "{{ .Values.image.baseRepo }}{{ .Values.image.csiProvisioner.repository }}:{{ .Values.image.csiProvisioner.tag }}"
+{{- else }}
+          image: "{{ .Values.image.csiProvisioner.repository }}:{{ .Values.image.csiProvisioner.tag }}"
+{{- end }}
+          args:
+            - "-v=2"
+            - "--csi-address=$(ADDRESS)"
+            - "--leader-election"
+            - "--leader-election-namespace={{ .Release.Namespace }}"
+            - "--timeout=120s"
+            - "--extra-create-metadata=true"
+            - "--kube-api-qps=50"
+            - "--kube-api-burst=100"
+          env:
+            - name: ADDRESS
+              value: /csi/csi.sock
+          imagePullPolicy: {{ .Values.image.csiProvisioner.pullPolicy }}
+          volumeMounts:
+            - mountPath: /csi
+              name: socket-dir
+          resources: {{- toYaml .Values.controller.resources.csiProvisioner | nindent 12 }}
+        - name: liveness-probe
+{{- if hasPrefix "/" .Values.image.livenessProbe.repository }}
+          image: "{{ .Values.image.baseRepo }}{{ .Values.image.livenessProbe.repository }}:{{ .Values.image.livenessProbe.tag }}"
+{{- else }}
+          image: "{{ .Values.image.livenessProbe.repository }}:{{ .Values.image.livenessProbe.tag }}"
+{{- end }}
+          args:
+            - --csi-address=/csi/csi.sock
+            - --probe-timeout=3s
+            - --health-port={{ .Values.controller.livenessProbe.healthPort }}
+          imagePullPolicy: {{ .Values.image.livenessProbe.pullPolicy }}
+          volumeMounts:
+            - name: socket-dir
+              mountPath: /csi
+          resources: {{- toYaml .Values.controller.resources.livenessProbe | nindent 12 }}
+        - name: blob
+{{- if hasPrefix "/" .Values.image.blob.repository }}
+          image: "{{ .Values.image.baseRepo }}{{ .Values.image.blob.repository }}:{{ .Values.image.blob.tag }}"
+{{- else }}
+          image: "{{ .Values.image.blob.repository }}:{{ .Values.image.blob.tag }}"
+{{- end }}
+          args:
+            - "--v={{ .Values.controller.logLevel }}"
+            - "--endpoint=$(CSI_ENDPOINT)"
+            - "--metrics-address=0.0.0.0:{{ .Values.controller.metricsPort }}"
+            - "--drivername={{ .Values.driver.name }}"
+            - "--custom-user-agent={{ .Values.driver.customUserAgent }}"
+            - "--user-agent-suffix={{ .Values.driver.userAgentSuffix }}"
+            - "--cloud-config-secret-name={{ .Values.controller.cloudConfigSecretName }}"
+            - "--cloud-config-secret-namespace={{ .Values.controller.cloudConfigSecretNamespace }}"
+            - "--allow-empty-cloud-config={{ .Values.controller.allowEmptyCloudConfig }}"
+          ports:
+            - containerPort: {{ .Values.controller.livenessProbe.healthPort }}
+              name: healthz
+              protocol: TCP
+            - containerPort: {{ .Values.controller.metricsPort }}
+              name: metrics
+              protocol: TCP
+          livenessProbe:
+            failureThreshold: 5
+            httpGet:
+              path: /healthz
+              port: healthz
+            initialDelaySeconds: 30
+            timeoutSeconds: 10
+            periodSeconds: 30
+          env:
+            - name: AZURE_CREDENTIAL_FILE
+              valueFrom:
+                configMapKeyRef:
+                  name: azure-cred-file
+                  key: path
+                  optional: true
+            - name: POD_NAME
+              valueFrom:
+                fieldRef:
+                  fieldPath: metadata.name
+            - name: KUBERNETES_NAMESPACE
+              valueFrom:
+                fieldRef:
+                  fieldPath: metadata.namespace
+            - name: CSI_ENDPOINT
+              value: unix:///csi/csi.sock
+            {{- if ne .Values.driver.httpsProxy "" }}
+            - name: HTTPS_PROXY
+              value: {{ .Values.driver.httpsProxy }}
+            {{- end }}
+            {{- if ne .Values.driver.httpProxy "" }}
+            - name: HTTP_PROXY
+              value: {{ .Values.driver.httpProxy }}
+            {{- end }}
+            - name: AZURE_GO_SDK_LOG_LEVEL
+              value: {{ .Values.driver.azureGoSDKLogLevel }}
+            {{- if eq .Values.cloud "AzureStackCloud" }}
+            - name: AZURE_ENVIRONMENT_FILEPATH
+              value: /etc/kubernetes/azurestackcloud.json
+            {{- end }}
+          imagePullPolicy: {{ .Values.image.blob.pullPolicy }}
+          volumeMounts:
+            - mountPath: /csi
+              name: socket-dir
+            - mountPath: /etc/kubernetes/
+              name: azure-cred
+            {{- if eq .Values.cloud "AzureStackCloud" }}
+            - name: ssl
+              mountPath: /etc/ssl/certs
+              readOnly: true
+            {{- end }}
+            {{- if eq .Values.linux.distro "fedora" }}
+            - name: ssl
+              mountPath: /etc/ssl/certs
+              readOnly: true
+            - name: ssl-pki
+              mountPath: /etc/pki/ca-trust/extracted
+              readOnly: true
+            {{- end }}
+          resources: {{- toYaml .Values.controller.resources.blob | nindent 12 }}
+        - name: csi-resizer
+{{- if hasPrefix "/" .Values.image.csiResizer.repository }}
+          image: "{{ .Values.image.baseRepo }}{{ .Values.image.csiResizer.repository }}:{{ .Values.image.csiResizer.tag }}"
+{{- else }}
+          image: "{{ .Values.image.csiResizer.repository }}:{{ .Values.image.csiResizer.tag }}"
+{{- end }}
+          args:
+            - "-csi-address=$(ADDRESS)"
+            - "-v=2"
+            - "-leader-election"
+            - "--leader-election-namespace={{ .Release.Namespace }}"
+            - '-handle-volume-inuse-error=false'
+          env:
+            - name: ADDRESS
+              value: /csi/csi.sock
+          imagePullPolicy: {{ .Values.image.csiResizer.pullPolicy }}
+          volumeMounts:
+            - name: socket-dir
+              mountPath: /csi
+          resources: {{- toYaml .Values.controller.resources.csiResizer | nindent 12 }}
+      volumes:
+        - name: socket-dir
+          emptyDir: {}
+        - name: azure-cred
+          hostPath:
+            path: /etc/kubernetes/
+            type: DirectoryOrCreate
+        {{- if eq .Values.cloud "AzureStackCloud" }}
+        - name: ssl
+          hostPath:
+            path: /etc/ssl/certs
+        {{- end }}
+        {{- if eq .Values.linux.distro "fedora" }}
+        - name: ssl
+          hostPath:
+            path: /etc/ssl/certs
+        - name: ssl-pki
+          hostPath:
+            path: /etc/pki/ca-trust/extracted
+        {{- end }}
+      {{- if .Values.securityContext }}
+      securityContext: {{- toYaml .Values.securityContext | nindent 8 }}
+      {{- end }}
diff --git a/charts/v4.7.0/blob-csi-driver/templates/csi-blob-driver.yaml b/charts/v4.7.0/blob-csi-driver/templates/csi-blob-driver.yaml
new file mode 100644
index 000000000..9a6aea64a
--- /dev/null
+++ b/charts/v4.7.0/blob-csi-driver/templates/csi-blob-driver.yaml
@@ -0,0 +1,14 @@
+---
+apiVersion: storage.k8s.io/v1
+kind: CSIDriver
+metadata:
+  name: {{ .Values.driver.name }}
+  labels:
+    {{- include "blob.labels" . | nindent 4 }}
+spec:
+  attachRequired: false
+  podInfoOnMount: true
+  fsGroupPolicy: {{ .Values.feature.fsGroupPolicy }}
+  volumeLifecycleModes:
+    - Persistent
+    - Ephemeral
diff --git a/charts/v4.7.0/blob-csi-driver/templates/csi-blob-node.yaml b/charts/v4.7.0/blob-csi-driver/templates/csi-blob-node.yaml
new file mode 100644
index 000000000..91c02dda0
--- /dev/null
+++ b/charts/v4.7.0/blob-csi-driver/templates/csi-blob-node.yaml
@@ -0,0 +1,296 @@
+kind: DaemonSet
+apiVersion: apps/v1
+metadata:
+  name: {{ .Values.node.name }}
+  namespace: {{ .Release.Namespace }}
+  labels:
+    app: {{ .Values.node.name }}
+    {{- include "blob.labels" . | nindent 4 }}
+spec:
+  updateStrategy:
+    rollingUpdate:
+      maxUnavailable: {{ .Values.node.maxUnavailable }}
+    type: RollingUpdate
+  selector:
+    matchLabels:
+      app: {{ .Values.node.name }}
+      {{- include "blob.selectorLabels" . | nindent 6 }}
+  template:
+    metadata:
+      labels:
+        app: {{ .Values.node.name }}
+        {{- include "blob.labels" . | nindent 8 }}
+        {{- if .Values.workloadIdentity.clientID }}
+        azure.workload.identity/use: "true"
+        {{- end }}
+        {{- if .Values.podLabels }}
+{{- toYaml .Values.podLabels | nindent 8 }}
+        {{- end }}
+{{- if .Values.podAnnotations }}
+      annotations:
+{{ toYaml .Values.podAnnotations | indent 8 }}
+{{- end }}
+    spec:
+      {{- if .Values.imagePullSecrets }}
+      imagePullSecrets:
+{{ toYaml .Values.imagePullSecrets | indent 8 }}
+      {{- end }}
+{{- if .Values.node.enableBlobfuseProxy }}
+      hostPID: true
+{{- end }}
+      hostNetwork: true
+      dnsPolicy: ClusterFirstWithHostNet
+      serviceAccountName: {{ .Values.serviceAccount.node }}
+      nodeSelector:
+        kubernetes.io/os: linux
+{{- with .Values.node.nodeSelector }}
+{{ toYaml . | indent 8 }}
+{{- end }}
+      affinity:
+        nodeAffinity:
+          requiredDuringSchedulingIgnoredDuringExecution:
+            nodeSelectorTerms:
+              - matchExpressions:
+                  - key: type
+                    operator: NotIn
+                    values:
+                      - virtual-kubelet
+        {{- if .Values.node.affinity }}
+{{- toYaml .Values.node.affinity | nindent 8 }}
+        {{- end }}
+      priorityClassName: {{ .Values.priorityClassName | quote }}
+      securityContext:
+        seccompProfile:
+          type: RuntimeDefault
+{{- with .Values.node.tolerations }}
+      tolerations:
+{{ toYaml . | indent 8 }}
+{{- end }}
+{{- if .Values.node.enableBlobfuseProxy }}
+      initContainers:
+        - name: install-blobfuse-proxy
+{{- if hasPrefix "/" .Values.image.blob.repository }}
+          image: "{{ .Values.image.baseRepo }}{{ .Values.image.blob.repository }}:{{ .Values.image.blob.tag }}"
+{{- else }}
+          image: "{{ .Values.image.blob.repository }}:{{ .Values.image.blob.tag }}"
+{{- end }}
+          imagePullPolicy: IfNotPresent
+          command:
+            - "/blobfuse-proxy/init.sh"
+          securityContext:
+            privileged: true
+          env:
+            - name: DEBIAN_FRONTEND
+              value: "noninteractive"
+            - name: INSTALL_BLOBFUSE
+              value: "{{ .Values.node.blobfuseProxy.installBlobfuse }}"
+            - name: BLOBFUSE_VERSION
+              value: "{{ .Values.node.blobfuseProxy.blobfuseVersion }}"
+            - name: INSTALL_BLOBFUSE2
+              value: "{{ .Values.node.blobfuseProxy.installBlobfuse2 }}"
+            - name: BLOBFUSE2_VERSION
+              value: "{{ .Values.node.blobfuseProxy.blobfuse2Version }}"
+            - name: SET_MAX_OPEN_FILE_NUM
+              value: "{{ .Values.node.blobfuseProxy.setMaxOpenFileNum }}"
+            - name: MAX_FILE_NUM
+              value: "{{ .Values.node.blobfuseProxy.maxOpenFileNum }}"
+            - name: DISABLE_UPDATEDB
+              value: "{{ .Values.node.blobfuseProxy.disableUpdateDB }}"
+          volumeMounts:
+            - name: host-usr
+              mountPath: /host/usr
+            - name: host-etc
+              mountPath: /host/etc
+{{- end }}
+      containers:
+        - name: liveness-probe
+          imagePullPolicy: {{ .Values.image.livenessProbe.pullPolicy }}
+          volumeMounts:
+            - mountPath: /csi
+              name: socket-dir
+{{- if hasPrefix "/" .Values.image.livenessProbe.repository }}
+          image: "{{ .Values.image.baseRepo }}{{ .Values.image.livenessProbe.repository }}:{{ .Values.image.livenessProbe.tag }}"
+{{- else }}
+          image: "{{ .Values.image.livenessProbe.repository }}:{{ .Values.image.livenessProbe.tag }}"
+{{- end }}
+          args:
+            - --csi-address=/csi/csi.sock
+            - --probe-timeout=3s
+            - --health-port={{ .Values.node.livenessProbe.healthPort }}
+            - --v=2
+          resources: {{- toYaml .Values.node.resources.livenessProbe | nindent 12 }}
+        - name: node-driver-registrar
+{{- if hasPrefix "/" .Values.image.nodeDriverRegistrar.repository }}
+          image: "{{ .Values.image.baseRepo }}{{ .Values.image.nodeDriverRegistrar.repository }}:{{ .Values.image.nodeDriverRegistrar.tag }}"
+{{- else }}
+          image: "{{ .Values.image.nodeDriverRegistrar.repository }}:{{ .Values.image.nodeDriverRegistrar.tag }}"
+{{- end }}
+          args:
+            - --csi-address=$(ADDRESS)
+            - --kubelet-registration-path=$(DRIVER_REG_SOCK_PATH)
+            - --v=2
+          livenessProbe:
+            exec:
+              command:
+                - /csi-node-driver-registrar
+                - --kubelet-registration-path=$(DRIVER_REG_SOCK_PATH)
+                - --mode=kubelet-registration-probe
+            initialDelaySeconds: 30
+            timeoutSeconds: 15
+          env:
+            - name: ADDRESS
+              value: /csi/csi.sock
+            - name: DRIVER_REG_SOCK_PATH
+              value: {{ .Values.linux.kubelet }}/plugins/{{ .Values.driver.name }}/csi.sock
+          volumeMounts:
+            - name: socket-dir
+              mountPath: /csi
+            - name: registration-dir
+              mountPath: /registration
+          resources: {{- toYaml .Values.node.resources.nodeDriverRegistrar | nindent 12 }}
+        - name: blob
+{{- if hasPrefix "/" .Values.image.blob.repository }}
+          image: "{{ .Values.image.baseRepo }}{{ .Values.image.blob.repository }}:{{ .Values.image.blob.tag }}"
+{{- else }}
+          image: "{{ .Values.image.blob.repository }}:{{ .Values.image.blob.tag }}"
+{{- end }}
+          args:
+            - "--v={{ .Values.node.logLevel }}"
+            - "--endpoint=$(CSI_ENDPOINT)"
+            - "--blobfuse-proxy-endpoint=$(BLOBFUSE_PROXY_ENDPOINT)"
+            - "--edgecache-mount-endpoint=$(EDGECACHE_MOUNT_ENDPOINT)"
+            - "--enable-blobfuse-proxy={{ .Values.node.enableBlobfuseProxy }}"
+            - "--nodeid=$(KUBE_NODE_NAME)"
+            - "--drivername={{ .Values.driver.name }}"
+            - "--cloud-config-secret-name={{ .Values.node.cloudConfigSecretName }}"
+            - "--cloud-config-secret-namespace={{ .Values.node.cloudConfigSecretNamespace }}"
+            - "--custom-user-agent={{ .Values.driver.customUserAgent }}"
+            - "--user-agent-suffix={{ .Values.driver.userAgentSuffix }}"
+            - "--allow-empty-cloud-config={{ .Values.node.allowEmptyCloudConfig }}"
+            - "--enable-get-volume-stats={{ .Values.feature.enableGetVolumeStats }}"
+            - "--append-timestamp-cache-dir={{ .Values.node.appendTimeStampInCacheDir }}"
+            - "--mount-permissions={{ .Values.node.mountPermissions }}"
+            - "--allow-inline-volume-key-access-with-idenitity={{ .Values.node.allowInlineVolumeKeyAccessWithIdentity }}"
+          ports:
+            - containerPort: {{ .Values.node.livenessProbe.healthPort }}
+              name: healthz
+              protocol: TCP
+          livenessProbe:
+            failureThreshold: 5
+            httpGet:
+              path: /healthz
+              port: healthz
+            initialDelaySeconds: 30
+            timeoutSeconds: 10
+            periodSeconds: 30
+          env:
+            - name: AZURE_CREDENTIAL_FILE
+              valueFrom:
+                configMapKeyRef:
+                  name: azure-cred-file
+                  key: path
+                  optional: true
+            - name: POD_NAME
+              valueFrom:
+                fieldRef:
+                  fieldPath: metadata.name
+            - name: KUBERNETES_NAMESPACE
+              valueFrom:
+                fieldRef:
+                  fieldPath: metadata.namespace
+            - name: CSI_ENDPOINT
+              value: unix:///csi/csi.sock
+            - name: EDGECACHE_MOUNT_ENDPOINT
+              value: unix:///csi/csi_mounts.sock
+            - name: BLOBFUSE_PROXY_ENDPOINT
+              value: unix:///csi/blobfuse-proxy.sock
+            {{- if ne .Values.driver.httpsProxy "" }}
+            - name: HTTPS_PROXY
+              value: {{ .Values.driver.httpsProxy }}
+            {{- end }}
+            {{- if ne .Values.driver.httpProxy "" }}
+            - name: HTTP_PROXY
+              value: {{ .Values.driver.httpProxy }}
+            {{- end }}
+            - name: KUBE_NODE_NAME
+              valueFrom:
+                fieldRef:
+                  apiVersion: v1
+                  fieldPath: spec.nodeName
+            - name: AZURE_GO_SDK_LOG_LEVEL
+              value: {{ .Values.driver.azureGoSDKLogLevel }}
+            {{- if eq .Values.cloud "AzureStackCloud" }}
+            - name: AZURE_ENVIRONMENT_FILEPATH
+              value: /etc/kubernetes/azurestackcloud.json
+            {{- end }}
+          imagePullPolicy: {{ .Values.image.blob.pullPolicy }}
+          securityContext:
+            privileged: true
+          volumeMounts:
+            - mountPath: /csi
+              name: socket-dir
+            - mountPath: {{ .Values.linux.kubelet }}/
+              mountPropagation: Bidirectional
+              name: mountpoint-dir
+            - mountPath: /etc/kubernetes/
+              name: azure-cred
+            - mountPath: /mnt
+              name: blob-cache
+            {{- if eq .Values.cloud "AzureStackCloud" }}
+            - name: ssl
+              mountPath: /etc/ssl/certs
+              readOnly: true
+            {{- end }}
+            {{- if eq .Values.linux.distro "fedora" }}
+            - name: ssl
+              mountPath: /etc/ssl/certs
+              readOnly: true
+            - name: ssl-pki
+              mountPath: /etc/pki/ca-trust/extracted
+              readOnly: true
+            {{- end }}
+          resources: {{- toYaml .Values.node.resources.blob | nindent 12 }}
+      volumes:
+{{- if .Values.node.enableBlobfuseProxy }}
+        - name: host-usr
+          hostPath:
+            path: /usr
+        - name: host-etc
+          hostPath:
+            path: /etc
+{{- end }}
+        - hostPath:
+            path: {{ .Values.linux.kubelet }}/plugins/{{ .Values.driver.name }}
+            type: DirectoryOrCreate
+          name: socket-dir
+        - hostPath:
+            path: {{ .Values.linux.kubelet }}/
+            type: DirectoryOrCreate
+          name: mountpoint-dir
+        - hostPath:
+            path: {{ .Values.linux.kubelet }}/plugins_registry/
+            type: DirectoryOrCreate
+          name: registration-dir
+        - hostPath:
+            path: /etc/kubernetes/
+            type: DirectoryOrCreate
+          name: azure-cred
+        - hostPath:
+            path: {{ .Values.node.blobfuseCachePath }}
+          name: blob-cache
+        {{- if eq .Values.cloud "AzureStackCloud" }}
+        - name: ssl
+          hostPath:
+            path: /etc/ssl/certs
+        {{- end }}
+        {{- if eq .Values.linux.distro "fedora" }}
+        - name: ssl
+          hostPath:
+            path: /etc/ssl/certs
+        - name: ssl-pki
+          hostPath:
+            path: /etc/pki/ca-trust/extracted
+        {{- end }}
+      {{- if .Values.securityContext }}
+      securityContext: {{- toYaml .Values.securityContext | nindent 8 }}
+      {{- end }}
diff --git a/charts/v4.7.0/blob-csi-driver/templates/rbac-csi-blob-controller.yaml b/charts/v4.7.0/blob-csi-driver/templates/rbac-csi-blob-controller.yaml
new file mode 100644
index 000000000..f27935671
--- /dev/null
+++ b/charts/v4.7.0/blob-csi-driver/templates/rbac-csi-blob-controller.yaml
@@ -0,0 +1,121 @@
+{{- if .Values.rbac.create -}}
+kind: ClusterRole
+apiVersion: rbac.authorization.k8s.io/v1
+metadata:
+  name: {{ .Values.rbac.name }}-external-provisioner-role
+  labels:
+    {{- include "blob.labels" . | nindent 4 }}
+rules:
+  - apiGroups: [""]
+    resources: ["persistentvolumes"]
+    verbs: ["get", "list", "watch", "create", "delete"]
+  - apiGroups: [""]
+    resources: ["persistentvolumeclaims"]
+    verbs: ["get", "list", "watch", "update"]
+  - apiGroups: ["storage.k8s.io"]
+    resources: ["storageclasses"]
+    verbs: ["get", "list", "watch"]
+  - apiGroups: [""]
+    resources: ["events"]
+    verbs: ["get", "list", "watch", "create", "update", "patch"]
+  - apiGroups: ["storage.k8s.io"]
+    resources: ["csinodes"]
+    verbs: ["get", "list", "watch"]
+  - apiGroups: [""]
+    resources: ["nodes"]
+    verbs: ["get", "list", "watch"]
+  - apiGroups: ["coordination.k8s.io"]
+    resources: ["leases"]
+    verbs: ["get", "list", "watch", "create", "update", "patch"]
+
+---
+
+kind: ClusterRoleBinding
+apiVersion: rbac.authorization.k8s.io/v1
+metadata:
+  name: {{ .Values.rbac.name }}-csi-provisioner-binding
+  labels:
+    {{- include "blob.labels" . | nindent 4 }}
+subjects:
+  - kind: ServiceAccount
+    name: {{ .Values.serviceAccount.controller }}
+    namespace: {{ .Release.Namespace }}
+roleRef:
+  kind: ClusterRole
+  name: {{ .Values.rbac.name }}-external-provisioner-role
+  apiGroup: rbac.authorization.k8s.io
+
+---
+
+kind: ClusterRole
+apiVersion: rbac.authorization.k8s.io/v1
+metadata:
+  name: {{ .Values.rbac.name }}-external-resizer-role
+  labels:
+    {{- include "blob.labels" . | nindent 4 }}
+rules:
+  - apiGroups: [""]
+    resources: ["persistentvolumes"]
+    verbs: ["get", "list", "watch", "update", "patch"]
+  - apiGroups: [""]
+    resources: ["persistentvolumeclaims"]
+    verbs: ["get", "list", "watch"]
+  - apiGroups: [""]
+    resources: ["persistentvolumeclaims/status"]
+    verbs: ["update", "patch"]
+  - apiGroups: [""]
+    resources: ["events"]
+    verbs: ["list", "watch", "create", "update", "patch"]
+  - apiGroups: ["coordination.k8s.io"]
+    resources: ["leases"]
+    verbs: ["get", "list", "watch", "create", "update", "patch"]
+---
+kind: ClusterRoleBinding
+apiVersion: rbac.authorization.k8s.io/v1
+metadata:
+  name: {{ .Values.rbac.name }}-csi-resizer-role
+  labels:
+    {{- include "blob.labels" . | nindent 4 }}
+subjects:
+  - kind: ServiceAccount
+    name: {{ .Values.serviceAccount.controller }}
+    namespace: {{ .Release.Namespace }}
+roleRef:
+  kind: ClusterRole
+  name: {{ .Values.rbac.name }}-external-resizer-role
+  apiGroup: rbac.authorization.k8s.io
+
+---
+kind: ClusterRole
+apiVersion: rbac.authorization.k8s.io/v1
+metadata:
+  name: csi-{{ .Values.rbac.name }}-controller-secret-role
+  labels:
+    {{- include "blob.labels" . | nindent 4 }}
+rules:
+  - apiGroups: [""]
+    resources: ["secrets"]
+    verbs: ["get", "create"]
+  - apiGroups: [""]
+    resources: ["pods"]
+    verbs: ["get", "watch", "list"]
+  - apiGroups: [""]
+    resources: ["events"]
+    verbs: ["get", "list", "watch", "create", "update", "patch"]
+
+---
+kind: ClusterRoleBinding
+apiVersion: rbac.authorization.k8s.io/v1
+metadata:
+  name: csi-{{ .Values.rbac.name }}-controller-secret-binding
+  labels:
+    {{- include "blob.labels" . | nindent 4 }}
+subjects:
+  - kind: ServiceAccount
+    name: {{ .Values.serviceAccount.controller }}
+    namespace: {{ .Release.Namespace }}
+roleRef:
+  kind: ClusterRole
+  name: csi-{{ .Values.rbac.name }}-controller-secret-role
+  apiGroup: rbac.authorization.k8s.io
+{{ end }}
diff --git a/charts/v4.7.0/blob-csi-driver/templates/rbac-csi-blob-node.yaml b/charts/v4.7.0/blob-csi-driver/templates/rbac-csi-blob-node.yaml
new file mode 100644
index 000000000..6676656cf
--- /dev/null
+++ b/charts/v4.7.0/blob-csi-driver/templates/rbac-csi-blob-node.yaml
@@ -0,0 +1,44 @@
+{{- if .Values.rbac.create -}}
+---
+kind: ClusterRole
+apiVersion: rbac.authorization.k8s.io/v1
+metadata:
+  name: csi-{{ .Values.rbac.name }}-node-secret-role
+  labels:
+    {{- include "blob.labels" . | nindent 4 }}
+rules:
+  - apiGroups: [""]
+    resources: ["secrets"]
+    verbs: ["get"]
+
+    # the node plugin must apply annotations to the PVC for edgecache volumes
+    # it gets the PVC's through the PV's
+  - apiGroups: [""]
+    resources: ["persistentvolumes"]
+    verbs: ["get", "list"]
+  - apiGroups: [""]
+    resources: ["persistentvolumeclaims"]
+    verbs: ["get", "update"]
+  - apiGroups: [""]
+    resources: ["pods"]
+    verbs: ["get", "watch", "list"]
+  - apiGroups: [""]
+    resources: ["events"]
+    verbs: ["get", "list", "watch", "create"]
+
+---
+kind: ClusterRoleBinding
+apiVersion: rbac.authorization.k8s.io/v1
+metadata:
+  name: csi-{{ .Values.rbac.name }}-node-secret-binding
+  labels:
+    {{- include "blob.labels" . | nindent 4 }}
+subjects:
+  - kind: ServiceAccount
+    name: {{ .Values.serviceAccount.node }}
+    namespace: {{ .Release.Namespace }}
+roleRef:
+  kind: ClusterRole
+  name: csi-{{ .Values.rbac.name }}-node-secret-role
+  apiGroup: rbac.authorization.k8s.io
+{{ end }}
diff --git a/charts/v4.7.0/blob-csi-driver/templates/serviceaccount-csi-blob-controller.yaml b/charts/v4.7.0/blob-csi-driver/templates/serviceaccount-csi-blob-controller.yaml
new file mode 100644
index 000000000..7433bccf1
--- /dev/null
+++ b/charts/v4.7.0/blob-csi-driver/templates/serviceaccount-csi-blob-controller.yaml
@@ -0,0 +1,17 @@
+{{- if .Values.serviceAccount.create -}}
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: {{ .Values.serviceAccount.controller }}
+  namespace: {{ .Release.Namespace }}
+  labels:
+    {{- include "blob.labels" . | nindent 4 }}
+{{- if .Values.workloadIdentity.clientID }}
+    azure.workload.identity/use: "true"
+  annotations:
+    azure.workload.identity/client-id: {{ .Values.workloadIdentity.clientID }}
+{{- if .Values.workloadIdentity.tenantID }}
+    azure.workload.identity/tenant-id: {{ .Values.workloadIdentity.tenantID }}
+{{- end }}
+{{- end }}
+{{- end -}}
diff --git a/charts/v4.7.0/blob-csi-driver/templates/serviceaccount-csi-blob-node.yaml b/charts/v4.7.0/blob-csi-driver/templates/serviceaccount-csi-blob-node.yaml
new file mode 100644
index 000000000..a25090e30
--- /dev/null
+++ b/charts/v4.7.0/blob-csi-driver/templates/serviceaccount-csi-blob-node.yaml
@@ -0,0 +1,17 @@
+{{- if .Values.serviceAccount.create -}}
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: {{ .Values.serviceAccount.node }}
+  namespace: {{ .Release.Namespace }}
+  labels:
+    {{- include "blob.labels" . | nindent 4 }}
+{{- if .Values.workloadIdentity.clientID }}
+    azure.workload.identity/use: "true"
+  annotations:
+    azure.workload.identity/client-id: {{ .Values.workloadIdentity.clientID }}
+{{- if .Values.workloadIdentity.tenantID }}
+    azure.workload.identity/tenant-id: {{ .Values.workloadIdentity.tenantID }}
+{{- end }}
+{{- end }}
+{{- end -}}
diff --git a/charts/v4.7.0/blob-csi-driver/values.yaml b/charts/v4.7.0/blob-csi-driver/values.yaml
new file mode 100644
index 000000000..1ff9bbfaf
--- /dev/null
+++ b/charts/v4.7.0/blob-csi-driver/values.yaml
@@ -0,0 +1,173 @@
+image:
+  baseRepo: mcr.microsoft.com
+  blob:
+    repository: /k8s/csi/blob-csi
+    tag: latest
+    pullPolicy: IfNotPresent
+  csiProvisioner:
+    repository: /oss/kubernetes-csi/csi-provisioner
+    tag: v3.5.0
+    pullPolicy: IfNotPresent
+  livenessProbe:
+    repository: /oss/kubernetes-csi/livenessprobe
+    tag: v2.10.0
+    pullPolicy: IfNotPresent
+  nodeDriverRegistrar:
+    repository: /oss/kubernetes-csi/csi-node-driver-registrar
+    tag: v2.8.0
+    pullPolicy: IfNotPresent
+  csiResizer:
+    repository: /oss/kubernetes-csi/csi-resizer
+    tag: v1.8.0
+    pullPolicy: IfNotPresent
+
+cloud: AzurePublicCloud
+
+## Reference to one or more secrets to be used when pulling images
+## ref: https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/
+imagePullSecrets: []
+# - name: myRegistryKeySecretName
+
+serviceAccount:
+  create: true # When true, service accounts will be created for you. Set to false if you want to use your own.
+  controller: csi-blob-controller-sa # Name of Service Account to be created or used
+  node: csi-blob-node-sa # Name of Service Account to be created or used
+
+rbac:
+  create: true
+  name: blob
+
+## Collection of annotations to add to all the pods
+podAnnotations: {}
+## Collection of labels to add to all the pods
+podLabels: {}
+# -- Custom labels to add into metadata
+customLabels: {}
+  # k8s-app: blob-csi-driver
+
+## Leverage a PriorityClass to ensure your pods survive resource shortages
+## ref: https://kubernetes.io/docs/concepts/configuration/pod-priority-preemption/
+priorityClassName: system-cluster-critical
+## Security context give the opportunity to run container as nonroot by setting a securityContext
+## by example :
+## securityContext: { runAsUser: 1001 }
+securityContext: {}
+
+controller:
+  name: csi-blob-controller
+  cloudConfigSecretName: azure-cloud-provider
+  cloudConfigSecretNamespace: kube-system
+  allowEmptyCloudConfig: true
+  hostNetwork: true # this setting could be disabled if controller does not depend on MSI setting
+  metricsPort: 29634
+  livenessProbe:
+    healthPort: 29632
+  replicas: 2
+  runOnMaster: false
+  runOnControlPlane: false
+  logLevel: 5
+  resources:
+    csiProvisioner:
+      limits:
+        memory: 500Mi
+      requests:
+        cpu: 10m
+        memory: 20Mi
+    livenessProbe:
+      limits:
+        memory: 100Mi
+      requests:
+        cpu: 10m
+        memory: 20Mi
+    blob:
+      limits:
+        memory: 200Mi
+      requests:
+        cpu: 10m
+        memory: 20Mi
+    csiResizer:
+      limits:
+        memory: 500Mi
+      requests:
+        cpu: 10m
+        memory: 20Mi
+  affinity: {}
+  nodeSelector: {}
+  tolerations:
+    - key: "node-role.kubernetes.io/master"
+      operator: "Exists"
+      effect: "NoSchedule"
+    - key: "node-role.kubernetes.io/controlplane"
+      operator: "Exists"
+      effect: "NoSchedule"
+    - key: "node-role.kubernetes.io/control-plane"
+      operator: "Exists"
+      effect: "NoSchedule"
+
+node:
+  name: csi-blob-node
+  cloudConfigSecretName: azure-cloud-provider
+  cloudConfigSecretNamespace: kube-system
+  allowEmptyCloudConfig: true
+  allowInlineVolumeKeyAccessWithIdentity: false
+  maxUnavailable: 1
+  livenessProbe:
+    healthPort: 29633
+  logLevel: 5
+  enableBlobfuseProxy: false
+  blobfuseProxy:
+    installBlobfuse: true
+    blobfuseVersion: "1.4.5"
+    installBlobfuse2: true
+    blobfuse2Version: "2.0.3"
+    setMaxOpenFileNum: true
+    maxOpenFileNum: "9000000"
+    disableUpdateDB: true
+  blobfuseCachePath: /mnt
+  appendTimeStampInCacheDir: false
+  mountPermissions: 0777
+  resources:
+    livenessProbe:
+      limits:
+        memory: 100Mi
+      requests:
+        cpu: 10m
+        memory: 20Mi
+    nodeDriverRegistrar:
+      limits:
+        memory: 100Mi
+      requests:
+        cpu: 10m
+        memory: 20Mi
+    blob:
+      limits:
+        memory: 2100Mi
+      requests:
+        cpu: 10m
+        memory: 20Mi
+  affinity: {}
+  nodeSelector: {}
+  tolerations:
+    - operator: "Exists"
+
+feature:
+  fsGroupPolicy: ReadWriteOnceWithFSType
+  enableGetVolumeStats: false
+
+driver:
+  name: blob.csi.azure.com
+  customUserAgent: ""
+  userAgentSuffix: "OSS-helm"
+  azureGoSDKLogLevel: "" # available values: ""(no logs), DEBUG, INFO, WARNING, ERROR
+  httpsProxy: ""
+  httpProxy: ""
+
+linux:
+  kubelet: /var/lib/kubelet
+  distro: debian
+
+workloadIdentity:
+  clientID: ""
+  # [optional] If the AAD application or user-assigned managed identity is not in the same tenant as the cluster
+  # then set tenantID with the application or user-assigned managed identity tenant ID
+  tenantID: ""
diff --git a/pkg/blob/azure.go b/pkg/blob/azure.go
index 7a9d364b6..0f2054d75 100644
--- a/pkg/blob/azure.go
+++ b/pkg/blob/azure.go
@@ -78,7 +78,7 @@ func GetCloudProvider(ctx context.Context, kubeconfig, nodeID, secretName, secre
 	if kubeClient != nil {
 		az.KubeClient = kubeClient
 		klog.V(2).Infof("reading cloud config from secret %s/%s", secretNamespace, secretName)
-		config, err := configloader.Load[azure.Config](ctx, &configloader.K8sSecretLoaderConfig{
+		config, err = configloader.Load[azure.Config](ctx, &configloader.K8sSecretLoaderConfig{
 			K8sSecretConfig: configloader.K8sSecretConfig{
 				SecretName:      secretName,
 				SecretNamespace: secretNamespace,