{"record":{"id":"a759f5f15885bef2","repo":"argoproj/argo-workflows","slug":"unable-to-create-azure-blob-container-client-for","errorCode":null,"errorMessage":"unable to create Azure Blob Container client for %s: %w","messagePattern":"unable to create Azure Blob Container client for (.+?): %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"workflow/artifacts/azure/azure.go","lineNumber":289,"sourceCode":"\treturn response.Body, nil\n}\n\n// Save saves an artifact to Azure Blob Storage\nfunc (azblobDriver *ArtifactDriver) Save(ctx context.Context, path string, outputArtifact *wfv1.Artifact) error {\n\tlogger := logging.RequireLoggerFromContext(ctx)\n\tlogger.WithField(\"endpoint\", outputArtifact.Azure.Endpoint).\n\t\tWithField(\"container\", outputArtifact.Azure.Container).\n\t\tWithField(\"blob\", outputArtifact.Azure.Blob).\n\t\tInfo(ctx, \"Saving to Azure Blob Storage\")\n\n\tisDir, err := file.IsDirectory(path)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"failed to test if %s is a directory: %w\", path, err)\n\t}\n\n\tcontainerClient, err := azblobDriver.newAzureContainerClient(ctx)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"unable to create Azure Blob Container client for %s: %w\", outputArtifact.Azure.Blob, err)\n\t}\n\n\tif isDir {\n\t\terr := PutDirectory(ctx, containerClient, outputArtifact.Azure.Blob, path)\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"unable to upload directory %s to Azure: %w\", path, err)\n\t\t}\n\t} else {\n\t\terr := PutFile(ctx, containerClient, outputArtifact.Azure.Blob, path)\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"unable to upload file %s to Azure: %w\", path, err)\n\t\t}\n\t}\n\n\treturn nil\n}\n\n// SaveStream saves an artifact from an io.Reader to Azure Blob Storage","sourceCodeStart":271,"sourceCodeEnd":307,"githubUrl":"https://github.com/argoproj/argo-workflows/blob/35bff19146f5a6ada77468c431f2624bd577e373/workflow/artifacts/azure/azure.go#L271-L307","documentation":"Save builds an Azure container client (newAzureContainerClient) before uploading. If constructing the client fails — typically because credentials or the endpoint/account are missing or malformed — the error is wrapped with this message naming the blob.","triggerScenarios":"Save/SaveStream when the artifact repository config lacks accessKey/connection string, the AZURE_STORAGE_ACCOUNT/KEY env or secret is absent/invalid, or the endpoint URL cannot be parsed.","commonSituations":"artifactRepository azure block missing accessKey Secret ref; wrong secret key name; typo in account or endpoint (e.g. missing https:// or core.windows.net suffix); k8s secret in wrong namespace.","solutions":["Check artifactRepository config (workflow-controller-configmap) has correct azure endpoint, container, and accessKeySecret reference.","Verify the referenced Secret exists in the controller/workflow namespace and contains a valid account key.","Confirm endpoint format: https://<account>.blob.core.windows.net (or correct sovereign/ADLS endpoint).","Regenerate the key if the storage account key was rotated.","Test credentials manually: az storage container list with the same key."],"exampleFix":"// before: configmap\nartifactRepository:\n  azure:\n    endpoint: https://mystorageaccount.blob.core.windows.net\n    container: my-container\n// after: add secret ref\nartifactRepository:\n  azure:\n    endpoint: https://mystorageaccount.blob.core.windows.net\n    container: my-container\n    accessKeySecret:\n      name: azure-credentials\n      key: accessKey","handlingStrategy":"validation","validationCode":"if os.Getenv(\"AZURE_STORAGE_ACCOUNT\") == \"\" || os.Getenv(\"AZURE_STORAGE_ACCESS_KEY\") == \"\" {\n  return errors.New(\"azure credentials not configured\")\n}\nif _, err := url.Parse(endpoint); err != nil {\n  return fmt.Errorf(\"invalid azure endpoint: %w\", err)\n}","typeGuard":"func azureConfigValid(cfg *AzureArtifactRepository) bool {\n  return cfg != nil && cfg.Endpoint != \"\" && cfg.Container != \"\" &&\n    cfg.AccessKeySecret.Name != \"\" && cfg.AccessKeySecret.Key != \"\"\n}","tryCatchPattern":"err := driver.Save(ctx, path, artifact)\nif err != nil && strings.Contains(err.Error(), \"unable to create Azure Blob Container client\") {\n  // check configmap artifactRepository + secret before retrying\n  return fmt.Errorf(\"azure artifact config invalid: %w\", err)\n}","preventionTips":["Store azure access key in a Secret and reference it correctly in artifactRepository config.","Validate endpoint format https://<account>.blob.core.windows.net.","Rotate keys together with k8s Secret updates.","Run `argo lint`/config checks after controller config changes."],"tags":["azure","configuration","credentials","artifact"],"backgroundTag":"missing-azure-credentials","analyzedSha":"35bff19146f5a6ada77468c431f2624bd577e373","analyzedAt":"2026-09-03T19:34:35.908Z","contentChangedAt":"2026-09-03T19:34:35.908Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}