{"record":{"id":"8acd67a5c1878769","repo":"argoproj/argo-workflows","slug":"unable-to-create-default-azure-credential-w","errorCode":null,"errorMessage":"unable to create default Azure credential: %w","messagePattern":"unable to create default Azure credential: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"workflow/artifacts/azure/azure.go","lineNumber":55,"sourceCode":"\n// newAzureContainerClient creates a new container.Client for interacting with the specified Azure Blob Storage container\n// The container client is created with the default azblob.ClientOptions which does include retry behavior\n// for failed requests.\nfunc (azblobDriver *ArtifactDriver) newAzureContainerClient(ctx context.Context) (*container.Client, error) {\n\tcontainerURL, err := url.Parse(azblobDriver.Endpoint)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"unable to parse Azure Blob Storage endpoint url %s: %w\", azblobDriver.Endpoint, err)\n\t}\n\t// Append the container name to the URL path\n\tif len(containerURL.Path) == 0 || containerURL.Path[len(containerURL.Path)-1] != '/' {\n\t\tcontainerURL.Path += \"/\"\n\t}\n\tcontainerURL.Path += azblobDriver.Container\n\n\tif azblobDriver.UseSDKCreds {\n\t\tcredential, credErr := azidentity.NewDefaultAzureCredential(nil)\n\t\tif credErr != nil {\n\t\t\treturn nil, fmt.Errorf(\"unable to create default Azure credential: %w\", credErr)\n\t\t}\n\t\tcontainerClient, clientErr := container.NewClient(containerURL.String(), credential, nil)\n\t\treturn containerClient, clientErr\n\t}\n\tif azblobDriver.AccountKey == \"\" {\n\t\treturn nil, fmt.Errorf(\"accountKey secret is required for Azure Blob Storage if useSDKCreds is false\")\n\t}\n\n\tif isSASAccountKey(azblobDriver.AccountKey) {\n\t\tlogger := logging.RequireLoggerFromContext(ctx)\n\t\tlogger.Info(ctx, \"Provided account key is a SAS token. Using no-credential client.\")\n\t\tserviceURL := fmt.Sprintf(\"%s?%s\", containerURL.String(), azblobDriver.AccountKey)\n\t\tcontainerClient, clientErr := container.NewClientWithNoCredential(serviceURL, nil)\n\t\treturn containerClient, clientErr\n\t}\n\n\taccountName, err := determineAccountName(containerURL)\n\tif err != nil {","sourceCodeStart":37,"sourceCodeEnd":73,"githubUrl":"https://github.com/argoproj/argo-workflows/blob/35bff19146f5a6ada77468c431f2624bd577e373/workflow/artifacts/azure/azure.go#L37-L73","documentation":"When UseSDKCreds is true, the driver builds an azidentity.NewDefaultAzureCredential chain (environment, managed identity, Azure CLI, etc.); if the chained credential cannot be constructed, this wrapped error is returned.","triggerScenarios":"useSDKCreds: true is set but the pod environment provides no credential source: missing AZURE_TENANT_ID/AZURE_CLIENT_ID/AZURE_CLIENT_SECRET, no managed identity / workload identity binding on the pod, and no Azure CLI login available.","commonSituations":"Running the workflow pod without workload-identity labels/annotations in AKS; forgot to mount service-principal env vars from a secret; local dev without az login when testing Azurite against SDK creds.","solutions":["Configure workload identity or a managed identity on the executor pod (AKS: use workload identity federation labels).","Provide AZURE_TENANT_ID, AZURE_CLIENT_ID and AZURE_CLIENT_SECRET via envFrom a secret for service-principal auth.","If you instead use a static account key, set useSDKCreds: false and supply the accountKey secret.","Check the wrapped azidentity cause to see which credential in the chain was rejected."],"exampleFix":"// before\nazure:\n  useSDKCreds: true\n// after — ensure pod has workload identity, or fall back to account key\nazure:\n  accountKeySecret:\n    name: azure-creds\n    key: account-key","handlingStrategy":"fallback","validationCode":"// before relying on SDK creds, confirm a credential source exists:\nhasEnvSP := os.Getenv(\"AZURE_CLIENT_ID\") != \"\" && os.Getenv(\"AZURE_TENANT_ID\") != \"\" && os.Getenv(\"AZURE_CLIENT_SECRET\") != \"\"\n// otherwise attach workload identity or use accountKeySecret","typeGuard":null,"tryCatchPattern":"credential, credErr := azidentity.NewDefaultAzureCredential(nil)\nif credErr != nil {\n\tlogger.Error(ctx, \"no Azure credential chain available; falling back to accountKeySecret\")\n\treturn useAccountKeyFlow(ctx)\n}","preventionTips":["Attach workload identity labels/annotations to the executor pod in AKS.","Inject AZURE_TENANT_ID/AZURE_CLIENT_ID/AZURE_CLIENT_SECRET via envFrom when using a service principal.","Smoke-test Azure artifact download with a tiny workflow after identity changes."],"tags":["azure","authentication","identity"],"backgroundTag":"missing-azure-credentials","analyzedSha":"35bff19146f5a6ada77468c431f2624bd577e373","analyzedAt":"2026-09-03T19:34:35.908Z","contentChangedAt":"2026-09-03T19:34:35.908Z","schemaVersion":2},"datasetVersion":"2026-09-08T15:18:49.778Z"}