{"record":{"id":"4edf8d3ab7014752","repo":"kubernetes/kops","slug":"unset-azure-storage-account-the-storage-account-b","errorCode":null,"errorMessage":"unset AZURE_STORAGE_ACCOUNT; the storage account belongs in the URL:  azureblob://<account>/<container>/<key>","messagePattern":"unset AZURE_STORAGE_ACCOUNT; the storage account belongs in the URL:  azureblob://<account>/<container>/<key>","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"util/pkg/vfs/context.go","lineNumber":571,"sourceCode":"\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"invalid openstack cloud storage path: %q\", p)\n\t}\n\n\tif u.Scheme != \"swift\" {\n\t\treturn nil, fmt.Errorf(\"invalid openstack cloud storage path: %q\", p)\n\t}\n\n\tbucket := strings.TrimSuffix(u.Host, \"/\")\n\tif bucket == \"\" {\n\t\treturn nil, fmt.Errorf(\"invalid swift path: %q\", p)\n\t}\n\n\treturn NewSwiftPath(c, bucket, u.Path)\n}\n\nfunc (c *VFSContext) buildAzureBlobPath(p string) (*AzureBlobPath, error) {\n\tif os.Getenv(\"AZURE_STORAGE_ACCOUNT\") != \"\" {\n\t\treturn nil, fmt.Errorf(\"unset AZURE_STORAGE_ACCOUNT; the storage account belongs in the URL:  azureblob://<account>/<container>/<key>\")\n\t}\n\n\tu, err := url.Parse(p)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"failed to parse %q: %s\", p, err)\n\t}\n\n\tif u.Scheme != \"azureblob\" {\n\t\treturn nil, fmt.Errorf(\"invalid Azure Blob scheme: %q\", p)\n\t}\n\n\taccount := strings.TrimSuffix(u.Host, \"/\")\n\tif account == \"\" {\n\t\treturn nil, fmt.Errorf(\"no storage account specified in %q; expected azureblob://<account>/<container>/<key>\", p)\n\t}\n\n\trest := strings.TrimPrefix(u.Path, \"/\")\n\tcontainer, key, _ := strings.Cut(rest, \"/\")","sourceCodeStart":553,"sourceCodeEnd":589,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/util/pkg/vfs/context.go#L553-L589","documentation":"buildAzureBlobPath requires the storage account to come from the azureblob:// URL host, not from the AZURE_STORAGE_ACCOUNT environment variable. As written the guard fires when AZURE_STORAGE_ACCOUNT is set (the check is os.Getenv(...) != \"\"), instructing you to unset it and encode the account in the URL: azureblob://<account>/<container>/<key>.","triggerScenarios":"Calling BuildVfsPath with an azureblob:// path while the AZURE_STORAGE_ACCOUNT environment variable has a non-empty value, causing buildAzureBlobPath to reject the call immediately.","commonSituations":"Developer has AZURE_STORAGE_ACCOUNT exported in their shell from Azure CLI/SDK workflows (az CLI, older SDK tooling) and then runs kops against an azureblob:// state store; CI environment pre-loading Azure SDK env vars; migration from SDK-style config to URL-based config.","solutions":["Unset the variable before running: `unset AZURE_STORAGE_ACCOUNT` (or `env -u AZURE_STORAGE_ACCOUNT kops ...`)","Move the account name into the URL host: azureblob://<account>/<container>/<key>","Audit CI/shell profiles for where AZURE_STORAGE_ACCOUNT is exported and remove it from that environment","Note the check's message/condition read inverted relative to each other — if you expected the error only when the variable is unset, verify your kops version's source; the remedy in both readings is URL-based accounts"],"exampleFix":"// before\nexport AZURE_STORAGE_ACCOUNT=mystorage\nkops ... KOPS_STATE_STORE=azureblob://mystorage/container\n// after\nunset AZURE_STORAGE_ACCOUNT\nexport KOPS_STATE_STORE=azureblob://mystorage/container\nkops ...","handlingStrategy":"validation","validationCode":"if os.Getenv(\"AZURE_STORAGE_ACCOUNT\") != \"\" { return errors.New(\"AZURE_STORAGE_ACCOUNT must be unset; embed the account in the URL as azureblob://<account>/<container>/<key>\") }","typeGuard":null,"tryCatchPattern":"if _, err := context.BuildVfsPath(p); err != nil { if strings.Contains(err.Error(), \"AZURE_STORAGE_ACCOUNT\") { /* advise unsetting the env var and using the URL form */ } return err }","preventionTips":["Never rely on AZURE_STORAGE_ACCOUNT for kops; use azureblob://<account>/... URLs","Sanitize the environment in CI (env -u AZURE_STORAGE_ACCOUNT) before invoking kops","Document the URL-based account convention for your team"],"tags":["azure","env-var","azureblob","configuration"],"backgroundTag":"missing-env-var","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T12:17:11.808Z"}