{"record":{"id":"abc35dc3e4242c6a","repo":"argoproj/argo-workflows","slug":"accountkey-secret-is-required-for-azure-blob-stora","errorCode":null,"errorMessage":"accountKey secret is required for Azure Blob Storage if useSDKCreds is false","messagePattern":"accountKey secret is required for Azure Blob Storage if useSDKCreds is false","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"workflow/artifacts/azure/azure.go","lineNumber":61,"sourceCode":"\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"unable to parse Azure Blob Storage endpoint url %s: %w\", azblobDriver.Endpoint, err)\n\t}\n\t// Append the container name to the URL path\n\tif len(containerURL.Path) == 0 || containerURL.Path[len(containerURL.Path)-1] != '/' {\n\t\tcontainerURL.Path += \"/\"\n\t}\n\tcontainerURL.Path += azblobDriver.Container\n\n\tif azblobDriver.UseSDKCreds {\n\t\tcredential, credErr := azidentity.NewDefaultAzureCredential(nil)\n\t\tif credErr != nil {\n\t\t\treturn nil, fmt.Errorf(\"unable to create default Azure credential: %w\", credErr)\n\t\t}\n\t\tcontainerClient, clientErr := container.NewClient(containerURL.String(), credential, nil)\n\t\treturn containerClient, clientErr\n\t}\n\tif azblobDriver.AccountKey == \"\" {\n\t\treturn nil, fmt.Errorf(\"accountKey secret is required for Azure Blob Storage if useSDKCreds is false\")\n\t}\n\n\tif isSASAccountKey(azblobDriver.AccountKey) {\n\t\tlogger := logging.RequireLoggerFromContext(ctx)\n\t\tlogger.Info(ctx, \"Provided account key is a SAS token. Using no-credential client.\")\n\t\tserviceURL := fmt.Sprintf(\"%s?%s\", containerURL.String(), azblobDriver.AccountKey)\n\t\tcontainerClient, clientErr := container.NewClientWithNoCredential(serviceURL, nil)\n\t\treturn containerClient, clientErr\n\t}\n\n\taccountName, err := determineAccountName(containerURL)\n\tif err != nil {\n\t\treturn nil, err\n\t}\n\tcredential, err := azblob.NewSharedKeyCredential(accountName, azblobDriver.AccountKey)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"unable to create Azure shared key credential: %w\", err)\n\t}","sourceCodeStart":43,"sourceCodeEnd":79,"githubUrl":"https://github.com/argoproj/argo-workflows/blob/35bff19146f5a6ada77468c431f2624bd577e373/workflow/artifacts/azure/azure.go#L43-L79","documentation":"The Azure driver requires either SDK-based credentials (UseSDKCreds) or a static account key; when useSDKCreds is false/absent and AccountKey is empty, newAzureContainerClient fails fast with this message.","triggerScenarios":"Azure artifact storage config omits useSDKCreds (defaults false) and no accountKey/accountKeySecret is provided, or the referenced secret key resolves to an empty string.","commonSituations":"Switched to SDK creds but forgot to set useSDKCreds: true; secret key name mismatch so GetSecret returned empty; artifact repository configmap references a secret that was never created.","solutions":["Add an accountKeySecret to the azure storage config (name + key of a k8s secret holding the storage account key).","Or set useSDKCreds: true and provide workload identity / service principal credentials.","Verify the secret exists in the controller's namespace and its key matches the config (kubectl get secret <name> -o jsonpath='{.data.<key>}')."],"exampleFix":"// before — artifactRepository config\nazure:\n  endpoint: https://acct.blob.core.windows.net\n  container: my-container\n// after\nazure:\n  endpoint: https://acct.blob.core.windows.net\n  container: my-container\n  accountKeySecret:\n    name: azure-storage-creds\n    key: account-key","handlingStrategy":"validation","validationCode":"func azureConfigComplete(cfg AzureConfig, cs kubernetes.Interface, ns string) error {\n\tif cfg.UseSDKCreds { return nil }\n\tif cfg.AccountKeySecret == nil { return fmt.Errorf(\"azure: set useSDKCreds: true or provide accountKeySecret\") }\n\t_, err := cs.CoreV1().Secrets(ns).Get(ctx, cfg.AccountKeySecret.Name, metav1.GetOptions{})\n\treturn err\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Always pair an azure storage config with either useSDKCreds: true or accountKeySecret.","Create the accountKey secret in the same namespace as the controller before applying the configmap.","Assert secret key names match the config in your deploy pipeline."],"tags":["azure","configuration","missing-secret"],"backgroundTag":"missing-azure-account-key","analyzedSha":"35bff19146f5a6ada77468c431f2624bd577e373","analyzedAt":"2026-09-03T19:34:35.908Z","contentChangedAt":"2026-09-03T19:34:35.908Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}