{"record":{"id":"96000cdf4cf18c54","repo":"kubernetes/kops","slug":"creating-vmsss-client-w","errorCode":null,"errorMessage":"creating VMSSs client: %w","messagePattern":"creating VMSSs client: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"critical","filePath":"upup/pkg/fi/cloudup/azure/vmscaleset.go","lineNumber":102,"sourceCode":"\t}\n\treturn &resp.VirtualMachineScaleSet, nil\n}\n\nfunc (c *vmScaleSetsClientImpl) Delete(ctx context.Context, resourceGroupName, vmssName string) error {\n\tfuture, err := c.c.BeginDelete(ctx, resourceGroupName, vmssName, nil)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"deleting VMSS: %w\", err)\n\t}\n\tif _, err := future.PollUntilDone(ctx, nil); err != nil {\n\t\treturn fmt.Errorf(\"waiting for VMSS deletion completion: %w\", err)\n\t}\n\treturn nil\n}\n\nfunc newVMScaleSetsClientImpl(subscriptionID string, cred *azidentity.DefaultAzureCredential) (*vmScaleSetsClientImpl, error) {\n\tc, err := compute.NewVirtualMachineScaleSetsClient(subscriptionID, cred, nil)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"creating VMSSs client: %w\", err)\n\t}\n\treturn &vmScaleSetsClientImpl{\n\t\tc: c,\n\t}, nil\n}\n","sourceCodeStart":84,"sourceCodeEnd":108,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/upup/pkg/fi/cloudup/azure/vmscaleset.go#L84-L108","documentation":"This error is returned when the Azure SDK fails to construct compute.NewVirtualMachineScaleSetsClient (the ARM client object) for the given subscriptionID and credential. This happens almost exclusively during client instantiation/parameter validation inside the SDK — not when making API calls. It is surfaced during newAzureCloud, so an Azure cluster build fails immediately at cloud-init time.","triggerScenarios":"newVMScaleSetsClientImpl calls compute.NewVirtualMachineScaleSetsClient(subscriptionID, cred, nil) and the SDK returns an error: nil credential, invalid/empty subscriptionID, or internal SDK failure building the client pipeline (rare; e.g. bad client options).","commonSituations":"AZURE_SUBSCRIPTION_ID unset or empty in the environment so an empty subscriptionID is passed; DefaultAzureCredential construction succeeded but returned a nil/degenerate credential; version mismatch between azure-sdk-for-go modules (mismatched azcore versions) breaking client construction; programmatic use passing an uninitialized credential.","solutions":["Ensure AZURE_SUBSCRIPTION_ID is set and non-empty before running kops (echo $AZURE_SUBSCRIPTION_ID)","Verify the azidentity.DefaultAzureCredential was constructed without error and is non-nil before passing it in","Run az account show to confirm the subscription ID matches the intended tenant","Check go.mod for consistent azure-sdk-for-go / azcore module versions; run make gomod to reconcile","If constructing clients in custom code, validate subscriptionID with a regex before calling the SDK"],"exampleFix":"// before\ncred, _ := azidentity.NewDefaultAzureCredential(nil)\nclient, err := azure.NewCloud(ctx, \"\", cred) // empty subscriptionID\n// after\nif os.Getenv(\"AZURE_SUBSCRIPTION_ID\") == \"\" {\n\treturn fmt.Errorf(\"AZURE_SUBSCRIPTION_ID must be set\")\n}\ncred, err := azidentity.NewDefaultAzureCredential(nil)\nif err != nil { return err }\nclient, err := azure.NewCloud(ctx, os.Getenv(\"AZURE_SUBSCRIPTION_ID\"), cred)","handlingStrategy":"validation","validationCode":"// Go: validate inputs before constructing Azure clients\nsubID := os.Getenv(\"AZURE_SUBSCRIPTION_ID\")\nif subID == \"\" {\n\treturn fmt.Errorf(\"AZURE_SUBSCRIPTION_ID must be set\")\n}\nif !regexp.MustCompile(`^[0-9a-fA-F-]{36}$`).MatchString(subID) {\n\treturn fmt.Errorf(\"AZURE_SUBSCRIPTION_ID %q is not a valid UUID\", subID)\n}\ncred, err := azidentity.NewDefaultAzureCredential(nil)\nif err != nil || cred == nil {\n\treturn fmt.Errorf(\"building Azure credential: %w\", err)\n}","typeGuard":"func validSubscriptionID(s string) bool {\n\tre := regexp.MustCompile(`^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$`)\n\treturn re.MatchString(strings.ToLower(s))\n}","tryCatchPattern":null,"preventionTips":["Always export AZURE_SUBSCRIPTION_ID (and tenant/credential vars) before running kops","Validate the subscription ID format before passing it to Azure clients","Check the error from azidentity.NewDefaultAzureCredential and never pass a nil credential","Keep azure-sdk-for-go and azcore module versions aligned (run make gomod after upgrades)","Smoke-test credentials with `az account show` in CI before cluster operations"],"tags":["azure","client-construction","configuration","vmss"],"backgroundTag":"missing-env-var","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T12:17:11.808Z"}