{"record":{"id":"67f260d7441ead5a","repo":"cilium/cilium","slug":"unable-to-create-azure-client-w","errorCode":null,"errorMessage":"unable to create Azure client: %w","messagePattern":"unable to create Azure client: %w","errorType":"console","errorClass":null,"httpStatus":null,"severity":"error","filePath":"operator/pkg/ipam/allocator/azure/azure.go","lineNumber":75,"sourceCode":"\t\t}\n\t\tsubscriptionID = subID\n\t\ta.logger.Debug(\"Detected subscriptionID via Azure IMS\", logfields.SubscriptionID, subscriptionID)\n\t}\n\n\tresourceGroupName := a.AzureResourceGroup\n\tif resourceGroupName == \"\" {\n\t\ta.logger.Debug(\"ResourceGroupName was not specified via CLI, retrieving it via Azure IMS\")\n\t\trgName, err := metadata.GetResourceGroupName(ctx, a.rootLogger)\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"Azure resource group name was not specified via CLI and retrieving it from the Azure IMS was not possible: %w\", err)\n\t\t}\n\t\tresourceGroupName = rgName\n\t\ta.logger.Debug(\"Detected resource group name via Azure IMS\", logfields.Resource, resourceGroupName)\n\t}\n\n\tazureClient, err := api.NewClient(a.rootLogger, azureCloudName, subscriptionID, resourceGroupName, a.AzureUserAssignedIdentityID, a.AzureMetrics, a.LimitIPAMAPIQPS, a.LimitIPAMAPIBurst, a.AzureUsePrimaryAddress)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"unable to create Azure client: %w\", err)\n\t}\n\tinstances := ipam.NewInstancesManager(a.rootLogger, azureClient, a.AzureUsePrimaryAddress)\n\tnodeManager, err := nodemanager.NewNodeManager(a.logger, instances, getterUpdater, iMetrics, a.ParallelAllocWorkers, false, 0, false)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"unable to initialize Azure node manager: %w\", err)\n\t}\n\n\tif err := nodeManager.Start(ctx); err != nil {\n\t\treturn nil, err\n\t}\n\n\treturn nodeManager, nil\n}\n","sourceCodeStart":57,"sourceCodeEnd":89,"githubUrl":"https://github.com/cilium/cilium/blob/ac7b90affa4baf0642e6685319d56907b3a73a6d/operator/pkg/ipam/allocator/azure/azure.go#L57-L89","documentation":"AllocatorAzure.Start failed constructing the Azure API client via api.NewClient, which wraps the Azure SDK (compute/network interfaces) with the resolved cloud name, subscription ID, resource group, and user-assigned identity. A construction failure (bad identity ID, invalid parameters) is wrapped and aborts Azure IPAM startup.","triggerScenarios":"api.NewClient returns an error — commonly an invalid --azure-user-assigned-identity-id (wrong resource ID format), unsupported cloud name, or misconfigured rate-limit (QPS/burst) values.","commonSituations":"Passing a client-ID instead of the full resource ID for the user-assigned identity; using Azure Stack/China cloud with mismatched flags; negative QPS/burst limits from config typos.","solutions":["Read the wrapped cause in the operator log to see which client parameter failed.","Verify --azure-user-assigned-identity-id is the full resource ID: /subscriptions/<sub>/resourceGroups/<rg>/providers/Microsoft.ManagedIdentity/userAssignedIdentities/<name>.","Check --limit-ipam-api-qps and --limit-ipam-api-burst are positive numbers.","Validate --azure-cloud-name matches your tenant's cloud (AzurePublicCloud, AzureChinaCloud, etc.).","Confirm the user-assigned identity exists in the stated resource group and subscription."],"exampleFix":"// before\nargs: [\"--azure-user-assigned-identity-id=00000000-0000-0000-0000-000000000000\"]\n// after\nargs: [\"--azure-user-assigned-identity-id=/subscriptions/<sub>/resourceGroups/<rg>/providers/Microsoft.ManagedIdentity/userAssignedIdentities/my-identity\"]","handlingStrategy":"validation","validationCode":"if identityID != \"\" && !strings.HasPrefix(identityID, \"/subscriptions/\") { return errors.New(\"user-assigned identity must be a full resource ID\") }","typeGuard":null,"tryCatchPattern":"if _, err := azureAlloc.Start(ctx, gu, metrics); err != nil {\n\tif strings.Contains(err.Error(), \"Azure client\") { log.Fatalf(\"client construction failed: %v\", err) }\n\treturn err\n}","preventionTips":["Use full resource IDs for user-assigned identities","Keep QPS/burst limits positive and sane","Match --azure-cloud-name to the actual cloud environment","Pre-validate client flags in a startup preflight script"],"tags":["azure","client","identity","configuration","cilium-operator"],"backgroundTag":"invalid-azure-identity","analyzedSha":"ac7b90affa4baf0642e6685319d56907b3a73a6d","analyzedAt":"2026-08-31T18:27:15.868Z","schemaVersion":2},"datasetVersion":"2026-08-31T19:17:28.585Z"}