{"record":{"id":"109603e7f12b5338","repo":"weaviate/weaviate","slug":"init-azure-export-client","errorCode":null,"errorMessage":"init Azure export client","messagePattern":"init Azure export client","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"critical","filePath":"modules/backup-azure/module.go","lineNumber":106,"sourceCode":"\t}\n\tif config.Container == \"\" {\n\t\treturn errors.Errorf(\"backup init: '%s' must be set\", azureContainer)\n\t}\n\n\tclient, err := newClient(ctx, config, m.dataPath, m.logger)\n\tif err != nil {\n\t\treturn errors.Wrap(err, \"init Azure client\")\n\t}\n\tm.azureClient = client\n\n\texportConfig := &clientConfig{\n\t\tContainer:       \"\", // export scheduler provides bucket via EXPORT_DEFAULT_BUCKET\n\t\tBackupPath:      \"\", // export scheduler provides path via EXPORT_DEFAULT_PATH\n\t\tSkipAccessCheck: params.GetConfig().Export.SkipAccessCheck,\n\t}\n\texportClient, err := newClient(ctx, exportConfig, m.dataPath, m.logger)\n\tif err != nil {\n\t\treturn errors.Wrap(err, \"init Azure export client\")\n\t}\n\tm.exportClient = exportClient\n\treturn nil\n}\n\nfunc (m *Module) MetaInfo() (map[string]interface{}, error) {\n\tmetaInfo := make(map[string]interface{})\n\tmetaInfo[\"containerName\"] = m.config.Container\n\tif root := m.config.BackupPath; root != \"\" {\n\t\tmetaInfo[\"rootName\"] = root\n\t}\n\treturn metaInfo, nil\n}\n\n// ExportBackend returns the export-specific backend. It has no default\n// container or path; the export scheduler supplies both via\n// EXPORT_DEFAULT_BUCKET and EXPORT_DEFAULT_PATH.\nfunc (m *Module) ExportBackend() modulecapabilities.BackupBackend {","sourceCodeStart":88,"sourceCodeEnd":124,"githubUrl":"https://github.com/weaviate/weaviate/blob/75aa4b6d11f8818305aafd4440b4e32794f7ca04/modules/backup-azure/module.go#L88-L124","documentation":"Weaviate's backup-azure module wraps any failure from constructing the export-only Azure Blob client during module Init with the message \"init Azure export client\". The export client intentionally has no default container or path; it is configured lazily per export via EXPORT_DEFAULT_BUCKET and EXPORT_DEFAULT_PATH. newClient fails when Azure credentials are absent or malformed: AZURE_STORAGE_CONNECTION_STRING cannot be parsed, AZURE_STORAGE_ACCOUNT is unset, or AZURE_STORAGE_KEY cannot build a SharedKeyCredential. Because Init runs at server startup, this error aborts loading the module entirely.","triggerScenarios":"Server startup with backup-azure enabled when: (1) AZURE_STORAGE_CONNECTION_STRING is set but invalid (e.g. malformed key, missing AccountName segment) so azblob.NewClientFromConnectionString fails; (2) neither AZURE_STORAGE_CONNECTION_STRING nor AZURE_STORAGE_ACCOUNT is set; (3) AZURE_STORAGE_ACCOUNT is set but AZURE_STORAGE_KEY is empty/invalid, or DefaultAzureCredential (used when no key) cannot be constructed. Note the backup client (line 93) is initialized first, so the same root cause usually surfaces earlier as \"init Azure client\" — seeing the export variant means the primary env path succeeded differently or SkipAccessCheck masking differs.","commonSituations":"Kubernetes deployments where the secret mounting AZURE_STORAGE_CONNECTION_STRING is missing or has a typo'd key; switching from connection-string auth to account-name-only auth after a credentials rotation; running locally without any Azure env vars but with backup-azure in ENABLE_MODULES; malformed connection strings copied with quotes or extra whitespace.","solutions":["Set AZURE_STORAGE_CONNECTION_STRING to a valid Azure Blob connection string, or set both AZURE_STORAGE_ACCOUNT and AZURE_STORAGE_KEY.","Read the wrapped inner error in server logs — it states which step failed (\"create client using connection string\", \"AZURE_STORAGE_ACCOUNT must be set\", credential construction).","If using connection-string auth, verify it contains AccountName, AccountKey (or SAS), and BlobEndpoint segments, unquoted and semicolon-separated.","If relying on default-credential (no key), ensure the environment has valid Azure AD identity (managed identity on AKS, az login locally).","As a diagnostic only, set BACKUP_SKIP_ACCESS_CHECK / export skip-access-check — this does not fix credential construction; credentials are always required."],"exampleFix":"// before: module enabled but no Azure credentials in the environment\nAZURE_STORAGE_ACCOUNT=\"\"\nAZURE_STORAGE_KEY=\"\"\n\n// after: provide valid credentials (connection-string form)\nAZURE_STORAGE_CONNECTION_STRING=\"DefaultEndpointsProtocol=https;AccountName=mystorageacct;AccountKey=<base64-key>;BlobEndpoint=https://mystorageacct.blob.core.windows.net/\"","handlingStrategy":"validation","validationCode":"// Run before enabling backup-azure (e.g. in entrypoint/healthcheck):\nif [ -z \"$AZURE_STORAGE_CONNECTION_STRING\" ]; then\n  if [ -z \"$AZURE_STORAGE_ACCOUNT\" ]; then\n    echo \"backup-azure requires AZURE_STORAGE_CONNECTION_STRING or AZURE_STORAGE_ACCOUNT\" >&2\n    exit 1\n  fi\nfi","typeGuard":null,"tryCatchPattern":"err := module.Init(ctx, params)\nvar initErr *modstgazure.InitError\nif errors.As(err, &initErr) {\n    logger.Fatalf(\"backup-azure init failed: %v — check AZURE_STORAGE_* env vars\", initErr)\n}","preventionTips":["Provision AZURE_STORAGE_CONNECTION_STRING (or ACCOUNT+KEY) via a mounted secret, never inline env in manifests.","Validate the connection string parses and lists AccountName/BlobEndpoint before deploying.","Keep a startup smoke test that constructs the module in CI with the same secret shape used in production.","Watch startup logs for \"init Azure client\"/\"init Azure export client\" and alert on module init failure."],"tags":["azure","startup","configuration","credentials","backup-module"],"backgroundTag":"missing-azure-credentials","analyzedSha":"75aa4b6d11f8818305aafd4440b4e32794f7ca04","analyzedAt":"2026-09-04T14:58:20.392Z","contentChangedAt":"2026-09-04T14:58:20.392Z","schemaVersion":2},"datasetVersion":"2026-09-11T21:17:09.523Z"}