{"record":{"id":"b234cff2a2ad30c9","repo":"apache/flink","slug":"unable-to-retrieve-azure-storage-key-from-environm","errorCode":null,"errorMessage":"Unable to retrieve Azure storage key from environment. \"{}\" not set.","messagePattern":"Unable to retrieve Azure storage key from environment\\. \"(.+?)\" not set\\.","errorType":"exception","errorClass":"KeyProviderException","httpStatus":null,"severity":"error","filePath":"flink-filesystems/flink-azure-fs-hadoop/src/main/java/org/apache/flink/fs/azurefs/EnvironmentVariableKeyProvider.java","lineNumber":42,"sourceCode":"\n/**\n * An implementation of {@link org.apache.hadoop.fs.azure.KeyProvider}, which reads the Azure\n * storage key from an environment variable named \"AZURE_STORAGE_KEY\".\n */\npublic class EnvironmentVariableKeyProvider implements KeyProvider {\n\n    public static final String AZURE_STORAGE_KEY_ENV_VARIABLE = \"AZURE_STORAGE_KEY\";\n\n    @Override\n    public String getStorageAccountKey(final String s, final Configuration configuration)\n            throws KeyProviderException {\n\n        String azureStorageKey = System.getenv(AZURE_STORAGE_KEY_ENV_VARIABLE);\n\n        if (azureStorageKey != null) {\n            return azureStorageKey;\n        } else {\n            throw new KeyProviderException(\n                    \"Unable to retrieve Azure storage key from environment. \\\"\"\n                            + AZURE_STORAGE_KEY_ENV_VARIABLE\n                            + \"\\\" not set.\");\n        }\n    }\n}\n","sourceCodeStart":24,"sourceCodeEnd":49,"githubUrl":"https://github.com/apache/flink/blob/2f3c205e9266cb30240eb7f4fdab15cad629a70f/flink-filesystems/flink-azure-fs-hadoop/src/main/java/org/apache/flink/fs/azurefs/EnvironmentVariableKeyProvider.java#L24-L49","documentation":"Thrown by EnvironmentVariableKeyProvider.getStorageAccountKey when the AZURE_STORAGE_KEY environment variable is not set in the JVM's environment. This provider is a simple strategy for giving the Hadoop ABFS driver the storage account key; if the variable is absent it raises KeyProviderException during file system initialization.","triggerScenarios":"Configuring flink-azure-fs-hadoop with the environment-variable key provider (fs.azure.account.keyprovider.<account> = org.apache.flink.fs.azurefs.EnvironmentVariableKeyProvider) and then running the JobManager/TaskManager process without AZURE_STORAGE_KEY exported.","commonSituations":"Works in a shell but fails under systemd/Kubernetes/Docker where the variable was never injected into the service environment; variable set only on one node type; typo in the variable name.","solutions":["Export AZURE_STORAGE_KEY in the environment of EVERY Flink process (JobManager, TaskManager, CLI clients that touch the FS)","In Kubernetes, add it via env in the JM/TM pod specs or as a secret reference; for scripts, use env in flink-conf 'env.java.opts.all' only if unavoidable — prefer real process env","If you cannot control the environment, switch to SimpleKeyProvider-style configuration where the key lives in the Hadoop config (fs.azure.account.key.<account>) or use a custom KeyProvider reading a secret store","Verify with a trivial check: 'flink run' a job that calls System.getenv(\"AZURE_STORAGE_KEY\")"],"exampleFix":"# before (kubernetes pod spec has no env)\ncontainers:\n  - name: flink-taskmanager\n\n# after\ncontainers:\n  - name: flink-taskmanager\n    env:\n      - name: AZURE_STORAGE_KEY\n        valueFrom:\n          secretKeyRef:\n            name: azure-storage\n            key: storage-key","handlingStrategy":"validation","validationCode":"// before starting Flink processes\nString key = System.getenv(\"AZURE_STORAGE_KEY\");\nif (key == null || key.isEmpty()) {\n    throw new IllegalStateException(\n        \"AZURE_STORAGE_KEY must be set for EnvironmentVariableKeyProvider\");\n}","typeGuard":null,"tryCatchPattern":"try {\n    keyProvider.getStorageAccountKey(account, conf);\n} catch (org.apache.flink.fs.azurefs.KeyProviderException e) {\n    // env var missing on this process: fix the process environment, not the code\n    failFastWithEnvInstructions();\n}","preventionTips":["Inject AZURE_STORAGE_KEY via the orchestrator's secret mechanism into all JM/TM pods","Prefer config-file-based key providers when env control is limited","Add a startup env preflight check that fails deployment rather than runtime"],"tags":["azure","credentials","environment","configuration"],"backgroundTag":null,"analyzedSha":"2f3c205e9266cb30240eb7f4fdab15cad629a70f","analyzedAt":"2026-08-14T08:48:24.518Z","schemaVersion":2},"datasetVersion":"2026-08-14T10:17:34.591Z"}