diff --git a/chart/assets/operations/instance_groups/singleton-blobstore.yaml b/chart/assets/operations/instance_groups/singleton-blobstore.yaml
index c6d2a62f4d..2dba2a8140 100644
--- a/chart/assets/operations/instance_groups/singleton-blobstore.yaml
+++ b/chart/assets/operations/instance_groups/singleton-blobstore.yaml
@@ -13,7 +13,7 @@
 
 - type: replace
   path: /instance_groups/name=singleton-blobstore/jobs/name=blobstore/properties/blobstore/internal_access_rules?
-  value: [ "allow 10.0.0.0/8;","allow 172.16.0.0/12;", "allow 192.168.0.0/16;" , "allow 100.64.0.0/10;"]
+  value: [ "allow 10.0.0.0/8;","allow 172.16.0.0/12;", "allow 192.168.0.0/16;", "allow 100.64.0.0/10;"]
 - type: replace
   path: /instance_groups/name=singleton-blobstore/jobs/name=blobstore/properties/quarks?
   value:
@@ -50,4 +50,37 @@
 {{- range $bytes := .Files.Glob "assets/operations/pre_render_scripts/singleton-blobstore_*" }}
 {{ $bytes | toString }}
 {{- end }}
+
+{{- else }}
+- type: remove
+  path: /instance_groups/name=singleton-blobstore
+
+# remove unnecessary variables for internal blobstore
+- type: remove
+  path: /variables/name=blobstore_admin_users_password
+
+- type: remove
+  path: /variables/name=blobstore_secure_link_secret
+
+- type: remove
+  path: /variables/name=blobstore_tls
+
+{{- $buckets := dict }}
+{{- $_ := set $buckets "buildpacks" "buildpack" }}
+{{- $_ := set $buckets "droplets" "droplet" }}
+{{- $_ := set $buckets "packages" "app_package" }}
+{{- $_ := set $buckets "resource_pool" "resource" }}
+
+{{- range $bucket, $index := $buckets }}
+{{- include "_capi.setProperty" (list $bucket) }}
+
+{{- $path := printf "%s.fog_connection" $bucket }}
+{{- /* XXX Value should be "((fog_connection))" because it contains secrets */}}
+{{- include "_capi.setProperty" (list $path $.Values.features.blobstore.fog.connection) }}
+
+{{- $key := printf "%s_directory_key" $index }}
+{{- $path = printf "%s.%s" $bucket $key }}
+{{- include "_capi.setProperty" (list $path (index $.Values.features.blobstore.fog $key)) }}
+{{- end }}
+
 {{- end }}
diff --git a/chart/templates/_capi.tpl b/chart/templates/_capi.tpl
index 03d102e72a..f4c4d49a28 100644
--- a/chart/templates/_capi.tpl
+++ b/chart/templates/_capi.tpl
@@ -1,31 +1,45 @@
 {{- /*
 ==========================================================================================
-| _capi.setProperty $property $value
+| _capi.setProperty $property [$value]
 +-----------------------------------------------------------------------------------------
 | There are 4 CAPI jobs that all share the same cloud_controller_ng specs file,
 | and therefore potentially all use the same "cc" properties. This template will
 | set a property in all of the jobs, so there is a single location to keep track
 | of instance groups these jobs run in.
 |
+| If the property starts with "buildpacks" then it will only be set in the cloud
+| controller jobs (ng, worker, clock), because the other job(s) don't use/define
+| these properties.
+|
 | $property can use dotted path notation to specify nested properties,
 | e.g. "diego.foo" to set the "cc.diego.foo" property.
+|
+| If the $value is omitted, the property is removed from the manifest.
 ==========================================================================================
 */}}
 {{- define "_capi.setProperty" }}
-  {{- $property := index . 0 }}
-  {{- $value := index . 1 }}
+  {{- $params := . }}
+  {{- $property := index $params 0 }}
 
   {{- $ig := dict }}
   {{- $_ := set $ig "cloud_controller_ng"     "api"       }}
   {{- $_ := set $ig "cloud_controller_worker" "cc-worker" }}
   {{- $_ := set $ig "cloud_controller_clock"  "scheduler" }}
-  {{- $_ := set $ig "cc_deployment_updater"   "scheduler" }}
-  {{- /* XXX cc_route_syncer is not in cf-deployment; see CF-K8s-Networking */}}
-  {{- /* $_ := set $ig "cc_route_syncer" "???" */}}
+
+  {{- /* The buildpacks properties are only defined for the ng/worker/clock jobs */}}
+  {{- if not (hasPrefix "buildpacks" $property) }}
+    {{- $_ := set $ig "cc_deployment_updater"   "scheduler" }}
+    {{- /* XXX cc_route_syncer is not in cf-deployment; see CF-K8s-Networking */}}
+    {{- /* $_ := set $ig "cc_route_syncer" "???" */}}
+  {{- end }}
 
   {{- range $job, $instance_group := $ig }}
-- type: replace
-  path: /instance_groups/name={{ $instance_group }}/jobs/name={{ $job }}?/properties/cc/{{ $property | replace "." "/" }}
-  value: {{ $value | toJson }}
+- path: /instance_groups/name={{ $instance_group }}/jobs/name={{ $job }}?/properties/cc/{{ $property | replace "." "/" }}
+    {{- if eq (len $params) 1 }}
+  type: remove
+    {{- else }}
+  type: replace
+  value: {{ index $params 1 | toJson }}
+    {{- end }}
   {{- end }}
 {{- end }}
diff --git a/chart/templates/_features.tpl b/chart/templates/_features.tpl
index 4e7f8a2a54..ce01c45cb4 100644
--- a/chart/templates/_features.tpl
+++ b/chart/templates/_features.tpl
@@ -8,10 +8,10 @@
 */}}
 {{- define "_features.update" }}
   {{- /* Translate blobstore.provider feature into a proper boolean we can query in the conditions */}}
-  {{- if eq $.Values.features.blobstore.provider "s3" }}
-    {{- $_ := merge $.Values (dict "features" (dict "external_blobstore" (dict "enabled" true))) }}
-  {{- else }}
+  {{- if eq $.Values.features.blobstore.provider "singleton" }}
     {{- $_ := merge $.Values (dict "features" (dict "external_blobstore" (dict "enabled" false))) }}
+  {{- else }}
+    {{- $_ := merge $.Values (dict "features" (dict "external_blobstore" (dict "enabled" true))) }}
   {{- end}}
   {{- /* Fix routing_api to proper (per-scheduler) default when not overriden by user */}}
   {{- if kindIs "invalid" $.Values.features.routing_api.enabled }}
diff --git a/chart/templates/bosh_deployment.yaml b/chart/templates/bosh_deployment.yaml
index 1a514eefaa..669e20345e 100644
--- a/chart/templates/bosh_deployment.yaml
+++ b/chart/templates/bosh_deployment.yaml
@@ -38,18 +38,6 @@ spec:
     type: configmap
 {{- end }}
 
-{{- if eq .Values.features.blobstore.provider "s3" }}
-# S3 blobstore operations
-  - name: {{ include "kubecf.ops-name" (dict "Path" "assets/use-external-blobstore.yml") }}
-    type: configmap
-  - name: {{ include "kubecf.ops-name" (dict "Path" "assets/use-s3-blobstore.yml") }}
-    type: configmap
-{{- if .Values.features.eirini.enabled }}
-  - name: {{ include "kubecf.ops-name" (dict "Path" "assets/configure-bits-service-s3.yml") }}
-    type: configmap
-{{- end }}
-{{- end }}
-
 # Instance group operations
 {{- range $path, $bytes := .Files.Glob "assets/operations/instance_groups/*" }}
   - name: {{ include "kubecf.ops-name" (dict "Path" $path) }}
diff --git a/chart/templates/fog-blobstore.yaml b/chart/templates/fog-blobstore.yaml
new file mode 100644
index 0000000000..c7fda65181
--- /dev/null
+++ b/chart/templates/fog-blobstore.yaml
@@ -0,0 +1,20 @@
+{{- include "_config.load" $ }}
+
+{{- if eq .Values.features.blobstore.provider "fog" }}
+apiVersion: "v1"
+kind: "Secret"
+type: Opaque
+metadata:
+  name: var-fog-connection
+  namespace: {{ .Release.Namespace | quote }}
+  labels:
+    app.kubernetes.io/instance: {{ .Release.Name | quote }}
+    app.kubernetes.io/managed-by: {{ .Release.Service | quote }}
+    app.kubernetes.io/name: {{ include "kubecf.fullname" . }}
+    app.kubernetes.io/version: {{ default .Chart.Version .Chart.AppVersion | quote }}
+    helm.sh/chart: {{ include "kubecf.chart" . }}
+  annotations:
+    quarks.cloudfoundry.org/json-value: "true"
+stringData:
+  value: {{ .Values.features.blobstore.fog.connection | toJson | quote }}
+{{- end }}
diff --git a/chart/templates/ops.yaml b/chart/templates/ops.yaml
index 79489bd053..121e68fdb1 100644
--- a/chart/templates/ops.yaml
+++ b/chart/templates/ops.yaml
@@ -25,14 +25,6 @@ data:
 {{ include "kubecf.ops" (dict "Root" $root "Path" $path) }}
 {{- end }}
 
-{{- if eq .Values.features.blobstore.provider "s3" }}
-{{ include "kubecf.ops" (dict "Root" $root "Path" "assets/use-external-blobstore.yml") }}
-{{ include "kubecf.ops" (dict "Root" $root "Path" "assets/use-s3-blobstore.yml") }}
-{{- if .Values.features.eirini.enabled }}
-{{ include "kubecf.ops" (dict "Root" $root "Path" "assets/configure-bits-service-s3.yml") }}
-{{- end }}
-{{- end }}
-
 {{- range $path, $_ := .Files.Glob "assets/operations/instance_groups/*" }}
 {{ include "kubecf.ops" (dict "Root" $root "Path" $path) }}
 {{- end }}
diff --git a/chart/templates/s3-blobstore.yaml b/chart/templates/s3-blobstore.yaml
deleted file mode 100644
index 26e0d4525e..0000000000
--- a/chart/templates/s3-blobstore.yaml
+++ /dev/null
@@ -1,123 +0,0 @@
-{{- include "_config.load" $ }}
-{{- if eq .Values.features.blobstore.provider "s3" }}
-
-apiVersion: "v1"
-kind: "Secret"
-type: Opaque
-metadata:
-  name: var-blobstore-access-key-id
-  namespace: {{ .Release.Namespace | quote }}
-  labels:
-    app.kubernetes.io/instance: {{ .Release.Name | quote }}
-    app.kubernetes.io/managed-by: {{ .Release.Service | quote }}
-    app.kubernetes.io/name: {{ include "kubecf.fullname" . }}
-    app.kubernetes.io/version: {{ default .Chart.Version .Chart.AppVersion | quote }}
-    helm.sh/chart: {{ include "kubecf.chart" . }}
-stringData:
-  value: "{{ .Values.features.blobstore.s3.blobstore_access_key_id }}"
----
-apiVersion: "v1"
-kind: "Secret"
-type: Opaque
-metadata:
-  name: var-blobstore-secret-access-key
-  namespace: {{ .Release.Namespace | quote }}
-  labels:
-    app.kubernetes.io/instance: {{ .Release.Name | quote }}
-    app.kubernetes.io/managed-by: {{ .Release.Service | quote }}
-    app.kubernetes.io/name: {{ include "kubecf.fullname" . }}
-    app.kubernetes.io/version: {{ default .Chart.Version .Chart.AppVersion | quote }}
-    helm.sh/chart: {{ include "kubecf.chart" . }}
-stringData:
-  value: "{{ .Values.features.blobstore.s3.blobstore_secret_access_key }}"
----
-apiVersion: "v1"
-kind: "Secret"
-type: Opaque
-metadata:
-  name: var-app-package-directory-key
-  namespace: {{ .Release.Namespace | quote }}
-  labels:
-    app.kubernetes.io/instance: {{ .Release.Name | quote }}
-    app.kubernetes.io/managed-by: {{ .Release.Service | quote }}
-    app.kubernetes.io/name: {{ include "kubecf.fullname" . }}
-    app.kubernetes.io/version: {{ default .Chart.Version .Chart.AppVersion | quote }}
-    helm.sh/chart: {{ include "kubecf.chart" . }}
-stringData:
-  value: "{{ .Values.features.blobstore.s3.app_package_directory_key }}"
----
-apiVersion: "v1"
-kind: "Secret"
-type: Opaque
-metadata:
-  name: var-buildpack-directory-key
-  namespace: {{ .Release.Namespace | quote }}
-  labels:
-    app.kubernetes.io/instance: {{ .Release.Name | quote }}
-    app.kubernetes.io/managed-by: {{ .Release.Service | quote }}
-    app.kubernetes.io/name: {{ include "kubecf.fullname" . }}
-    app.kubernetes.io/version: {{ default .Chart.Version .Chart.AppVersion | quote }}
-    helm.sh/chart: {{ include "kubecf.chart" . }}
-stringData:
-  value: "{{ .Values.features.blobstore.s3.buildpack_directory_key }}"
----
-apiVersion: "v1"
-kind: "Secret"
-type: Opaque
-metadata:
-  name: var-droplet-directory-key
-  namespace: {{ .Release.Namespace | quote }}
-  labels:
-    app.kubernetes.io/instance: {{ .Release.Name | quote }}
-    app.kubernetes.io/managed-by: {{ .Release.Service | quote }}
-    app.kubernetes.io/name: {{ include "kubecf.fullname" . }}
-    app.kubernetes.io/version: {{ default .Chart.Version .Chart.AppVersion | quote }}
-    helm.sh/chart: {{ include "kubecf.chart" . }}
-stringData:
-  value: "{{ .Values.features.blobstore.s3.droplet_directory_key }}"
----
-apiVersion: "v1"
-kind: "Secret"
-type: Opaque
-metadata:
-  name: var-resource-directory-key
-  namespace: {{ .Release.Namespace | quote }}
-  labels:
-    app.kubernetes.io/instance: {{ .Release.Name | quote }}
-    app.kubernetes.io/managed-by: {{ .Release.Service | quote }}
-    app.kubernetes.io/name: {{ include "kubecf.fullname" . }}
-    app.kubernetes.io/version: {{ default .Chart.Version .Chart.AppVersion | quote }}
-    helm.sh/chart: {{ include "kubecf.chart" . }}
-stringData:
-  value: "{{ .Values.features.blobstore.s3.resource_directory_key }}"
----
-apiVersion: "v1"
-kind: "Secret"
-type: Opaque
-metadata:
-  name: var-blobstore-admin-users-password
-  namespace: {{ .Release.Namespace | quote }}
-  labels:
-    app.kubernetes.io/instance: {{ .Release.Name | quote }}
-    app.kubernetes.io/managed-by: {{ .Release.Service | quote }}
-    app.kubernetes.io/name: {{ include "kubecf.fullname" . }}
-    app.kubernetes.io/version: {{ default .Chart.Version .Chart.AppVersion | quote }}
-    helm.sh/chart: {{ include "kubecf.chart" . }}
-stringData:
-  value: "{{ .Values.features.blobstore.s3.blobstore_admin_users_password }}"
----
-apiVersion: "v1"
-kind: "Secret"
-type: Opaque
-metadata:
-  name: var-aws-region
-  namespace: {{ .Release.Namespace | quote }}
-  labels:
-    app.kubernetes.io/instance: {{ .Release.Name | quote }}
-    app.kubernetes.io/managed-by: {{ .Release.Service | quote }}
-    app.kubernetes.io/name: {{ include "kubecf.fullname" . }}
-    app.kubernetes.io/version: {{ default .Chart.Version .Chart.AppVersion | quote }}
-    helm.sh/chart: {{ include "kubecf.chart" . }}
-stringData:
-  value: "{{ .Values.features.blobstore.s3.aws_region }}"
-{{- end }}
diff --git a/chart/values.schema.yaml b/chart/values.schema.yaml
index db82994d75..a0c3cb3862 100644
--- a/chart/values.schema.yaml
+++ b/chart/values.schema.yaml
@@ -251,8 +251,59 @@ properties:
   features:
     type: object
     properties:
-      # "blobstore" doesn't have an "enabled" property
-      blobstore: {}
+      # Note: "blobstore" doesn't have an "enabled" property
+      blobstore:
+        type: object
+        oneOf:
+        - properties:
+            provider: {enum: [singleton]}
+          required: [provider]
+          additionalProperties: false
+        - properties:
+            provider: {enum: [fog]}
+            fog:
+              type: object
+              properties:
+                app_package_directory_key: {type: string}
+                buildpack_directory_key: {type: string}
+                droplet_directory_key: {type: string}
+                resource_directory_key: {type: string}
+                connection:
+                  type: object
+                  oneOf:
+                  - properties:
+                      provider: {enum: [AWS]}
+                      aws_access_key_id: {type: string}
+                      aws_secret_access_key: {type: string}
+                      aws_signature_version: {type: string}
+                      endpoint: {type: string}
+                      # path_style is not supported by bits_service
+                      path_style: {type: boolean}
+                      region: {type: string}
+                    required: [provider, aws_access_key_id, aws_secret_access_key]
+                    additionalProperties: false
+                  - properties:
+                      provider: {enum: [Google]}
+                      google_storage_access_key_id: {type: string}
+                      google_storage_secret_access_key: {type: string}
+                    required: [provider, google_storage_access_key_id, google_storage_secret_access_key]
+                    additionalProperties: false
+                  - properties:
+                      provider: {enum: [AzureRM]}
+                      azure_storage_access_key: {type: string}
+                      azure_storage_account_name: {type: string}
+                      environment: {type: string}
+                    required: [provider, environment, azure_storage_account_name, azure_storage_access_key]
+                    additionalProperties: false
+              required:
+              - app_package_directory_key
+              - buildpack_directory_key
+              - droplet_directory_key
+              - resource_directory_key
+              - connection
+              additionalProperties: false
+          required: [provider, fog]
+          additionalProperties: false
 
       memory_limits:
         # should "null" be allowed too?
diff --git a/chart/values.yaml b/chart/values.yaml
index 9a1f8e2134..cacc536bae 100644
--- a/chart/values.yaml
+++ b/chart/values.yaml
@@ -360,18 +360,44 @@ features:
     # Number of seconds to wait for the database to be ready, per iteration of the waiter loop
     connect_timeout: 3
   blobstore:
-    # Possible values for provider: singleton and s3.
+    # Possible values for provider: fog or singleton.
     provider: singleton
-    s3:
-      aws_region: ~
-      blobstore_access_key_id: ~
-      blobstore_secret_access_key: ~
-      blobstore_admin_users_password: ~
-      # The following values are used as S3 bucket names.
-      app_package_directory_key: ~
-      buildpack_directory_key: ~
-      droplet_directory_key: ~
-      resource_directory_key: ~
+    # fog:
+    #   app_package_directory_key: YOUR-APP-PACKAGE-BUCKET
+    #   buildpack_directory_key: YOUR-BUILDPACK-BUCKET
+    #   droplet_directory_key: YOUR-DROPLET-BUCKET
+    #   resource_directory_key: YOUR-RESOURCE-BUCKET
+    #
+    #   Example config for S3
+    #   ---------------------
+    #   connection:
+    #     provider: AWS
+    #     aws_access_key_id: S3-ACCESS-KEY
+    #     aws_secret_access_key: S3-SECRET-ACCESS-KEY
+    #     region: ""
+    #
+    #   Additional settings for e.g. MinIO
+    #   ----------------------------------
+    #     aws_signature_version: '2'
+    #     endpoint: S3-ENDPOINT
+    #     # path_style is only supported by Diego, but not by Eirini (bits-service).
+    #     # MinIO can be configured to use vhost addressing using MINIO_DOMAIN and a wildcard cert.
+    #     path_style: true
+    #
+    #   Example config for Google Cloud Storage
+    #   ---------------------------------------
+    #   connection:
+    #     provider: Google
+    #     google_storage_access_key_id: GCS-ACCESS-KEY
+    #     google_storage_secret_access_key: GCS-SECRET-ACCESS-KEY
+    #
+    #   Example config for Azure Cloud Storage
+    #   --------------------------------------
+    #   connection:
+    #     provider: AzureRM
+    #     environment: AzureCloud
+    #     azure_storage_account_name: YOUR-AZURE-STORAGE-ACCOUNT-NAME
+    #     azure_storage_access_key: YOUR-AZURE-STORAGE-ACCESS-KEY
 
   # Configuration for the external database; see also features.embedded_database.  Please refer to
   # https://kubecf.io/docs/deployment/kubernetes-deploy/#external-database for details.
diff --git a/mixins/bits/config/bits.yaml b/mixins/bits/config/bits.yaml
index 4c5dba5872..566eeef07c 100644
--- a/mixins/bits/config/bits.yaml
+++ b/mixins/bits/config/bits.yaml
@@ -2,9 +2,6 @@ bits:
   blobstore:
     serviceName: "singleton-blobstore"
     userName: "blobstore-user"
-    secret:
-      name: "var-blobstore-admin-users-password"
-      passwordPath: "password"
 
   global:
     images:
diff --git a/mixins/bits/templates/bits-config.yaml b/mixins/bits/templates/bits-config.yaml
index 70251db1c1..caa9a1ab3b 100644
--- a/mixins/bits/templates/bits-config.yaml
+++ b/mixins/bits/templates/bits-config.yaml
@@ -28,12 +28,7 @@ stringData:
     app_stash_config:
       maximum_size: 512M
       minimum_size: 64K
-    {{- if index (default (dict) .Values.bits) "blobstore_config" }}
-    buildpacks: {{ .Values.bits.blobstore_config.buildpacks | toJson }}
-    droplets: {{ .Values.bits.blobstore_config.droplets | toJson }}
-    packages: {{ .Values.bits.blobstore_config.packages | toJson }}
-    app_stash: {{ .Values.bits.blobstore_config.app_stash | toJson }}
-    {{- else }}
+    {{- if eq $.Values.features.blobstore.provider "singleton" }}
     buildpacks:
       blobstore_type: webdav
       webdav_config: &webdav_config
@@ -65,6 +60,85 @@ stringData:
       webdav_config:
         <<: *webdav_config
         directory_key: cc-resources
+    {{- else if eq $.Values.features.blobstore.fog.connection.provider "AWS" }}
+    buildpacks:
+      blobstore_type: aws
+      s3_config: &s3_config
+        bucket: {{ $.Values.features.blobstore.fog.buildpack_directory_key }}
+        access_key_id: {{ $.Values.features.blobstore.fog.connection.aws_access_key_id }}
+        secret_access_key: {{ $.Values.features.blobstore.fog.connection.aws_secret_access_key }}
+        region: {{ $.Values.features.blobstore.fog.connection.region }}
+        {{- with $.Values.features.blobstore.fog.connection.endpoint }}
+        host: {{ . }}
+        {{- end }}
+        {{- with $.Values.features.blobstore.fog.connection.aws_signature_version }}
+        signature_version: {{ . }}
+        {{- end }}
+        {{- with $.Values.features.blobstore.fog.connection.path_style }}
+          {{- include "_config.fail" "path_style bucket addresses are not supported by bits-service" }}
+        {{- end }}
+    droplets:
+      blobstore_type: aws
+      s3_config:
+        <<: *s3_config
+        bucket: {{ $.Values.features.blobstore.fog.droplet_directory_key }}
+    packages:
+      blobstore_type: aws
+      s3_config:
+        <<: *s3_config
+        bucket: {{ $.Values.features.blobstore.fog.app_package_directory_key }}
+    app_stash:
+      blobstore_type: aws
+      s3_config:
+        <<: *s3_config
+        bucket: {{ $.Values.features.blobstore.fog.resource_directory_key }}
+    {{- else if eq $.Values.features.blobstore.fog.connection.provider "Google" }}
+    buildpacks:
+      blobstore_type: google
+      gcp_config: &gcp_config
+        bucket: {{ $.Values.features.blobstore.fog.buildpack_directory_key }}
+        private_key_id: {{ $.Values.features.blobstore.fog.google_storage_access_key_id }}
+        private_key: {{ $.Values.features.blobstore.fog.google_storage_secret_access_key }}
+    droplets:
+      blobstore_type: google
+      gcp_config:
+        <<: *gcp_config
+        bucket: {{ $.Values.features.blobstore.fog.droplet_directory_key }}
+    packages:
+      blobstore_type: google
+      gcp_config:
+        <<: *gcp_config
+        bucket: {{ $.Values.features.blobstore.fog.app_package_directory_key }}
+    app_stash:
+      blobstore_type: google
+      gcp_config:
+        <<: *gcp_config
+        bucket: {{ $.Values.features.blobstore.fog.resource_directory_key }}
+    {{- else if eq $.Values.features.blobstore.fog.connection.provider "AzureRM" }}
+    buildpacks:
+      blobstore_type: azure
+      azure_config: &azure_config
+        container_name: {{ $.Values.features.blobstore.fog.buildpack_directory_key }}
+        account_name: {{ $.Values.features.blobstore.fog.azure_storage_account_name }}
+        account_key: {{ $.Values.features.blobstore.fog.azure_storage_access_key }}
+        environment: {{ $.Values.features.blobstore.fog.environment }}
+    droplets:
+      blobstore_type: azure
+      azure_config: &azure_config
+        <<: *azure_config
+        container_name: {{ $.Values.features.blobstore.fog.droplet_directory_key }}
+    packages:
+      blobstore_type: azure
+      azure_config: &azure_config
+        <<: *azure_config
+        container_name: {{ $.Values.features.blobstore.fog.app_package_directory_key }}
+    app_stash:
+      blobstore_type: azure
+      azure_config: &azure_config
+        <<: *azure_config
+        container_name: {{ $.Values.features.blobstore.fog.resource_directory_key }}
+    {{- else }}
+      {{- include "_config.fail" (printf "Blobstore provider %q is not supported by bits-service" $.Values.features.blobstore.fog.provider) }}
     {{- end }}
     enable_registry: true
 {{- end }}
diff --git a/mixins/bits/templates/bits.yaml b/mixins/bits/templates/bits.yaml
index 0bce3593cf..93e5ddcea1 100644
--- a/mixins/bits/templates/bits.yaml
+++ b/mixins/bits/templates/bits.yaml
@@ -35,13 +35,13 @@ spec:
         imagePullPolicy: Always
         ports:
         - containerPort: 8888
-        {{- if and (.Values.bits.blobstore.secret.name) (.Values.bits.blobstore.secret.passwordPath) }}
+        {{- if eq .Values.features.blobstore.provider "singleton" }}
         env:
         - name: BITS_BLOBSTORE_PASSWORD
           valueFrom:
             secretKeyRef:
-              key: "{{ .Values.bits.blobstore.secret.passwordPath }}"
-              name: "{{ .Values.bits.blobstore.secret.name }}"
+              key: password
+              name: var-blobstore-admin-users-password
         {{- end }}
         volumeMounts:
         - name: bits-config
diff --git a/scripts/image_list.rb b/scripts/image_list.rb
index 53edf69079..a73680e064 100644
--- a/scripts/image_list.rb
+++ b/scripts/image_list.rb
@@ -292,6 +292,7 @@ def images
   # image than external_database.
   values.features['embedded_database']['enabled'] = true
   values.features['external_database']['enabled'] = false
+  values.features['blobstore'].delete('enabled')
   deep_populate_nil_values(values.features)
 
   # Render the Helm chart.
diff --git a/scripts/kubecf-build.sh b/scripts/kubecf-build.sh
index 1ed932918c..de1f5422dc 100755
--- a/scripts/kubecf-build.sh
+++ b/scripts/kubecf-build.sh
@@ -19,8 +19,6 @@ y2j < "${HELM_DIR}/values.schema.yaml" > "${HELM_DIR}/values.schema.json"
 rm "${HELM_DIR}/values.schema.yaml"
 
 cp src/cf-deployment/cf-deployment.yml "${HELM_DIR}/assets"
-cp src/cf-deployment/operations/use-external-blobstore.yml "${HELM_DIR}/assets"
-cp src/cf-deployment/operations/use-s3-blobstore.yml "${HELM_DIR}/assets"
 
 for MIXIN in bits eirini eirinix; do
     for DIR in assets config templates; do