{"record":{"id":"c560a749d14a9625","repo":"argoproj/argo-workflows","slug":"unable-to-create-azure-blob-container-client-w","errorCode":null,"errorMessage":"unable to create Azure Blob Container client: %w","messagePattern":"unable to create Azure Blob Container client: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"workflow/artifacts/azure/azure.go","lineNumber":117,"sourceCode":"// isSASAccountKey determines whether the account key provided is a SAS token instead of a\n// storage account key. A SAS token is a string of query parameters that is appended to the\n// URL of the storage account. This function looks for the presence of a query parameter in\n// the string and returns true if found.\nfunc isSASAccountKey(accountKey string) bool {\n\tre := regexp.MustCompile(`(\\?|\\&)([^=]+)\\=([^&]+)`)\n\treturn re.MatchString(accountKey)\n}\n\n// Load downloads artifacts from Azure Blob Storage\nfunc (azblobDriver *ArtifactDriver) Load(ctx context.Context, artifact *wfv1.Artifact, path string) error {\n\tlogger := logging.RequireLoggerFromContext(ctx)\n\tlogger.WithField(\"endpoint\", artifact.Azure.Endpoint).\n\t\tWithField(\"container\", artifact.Azure.Container).\n\t\tWithField(\"blob\", artifact.Azure.Blob).\n\t\tInfo(ctx, \"Downloading from Azure Blob Storage\")\n\tcontainerClient, err := azblobDriver.newAzureContainerClient(ctx)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"unable to create Azure Blob Container client: %w\", err)\n\t}\n\n\t// Assume we're not downloading a directory and try to download as a file, since this is\n\t// the most common case and we don't want the penalty of listing the blobs before we\n\t// download (to determine if it's a directory instead of a single file). If we get a\n\t// BlobNotFound error, then check if it's a directory and process accordingly. If the account\n\t// has HNS enabled (ADLS Gen 2), then there's an edge case with using the blob API to\n\t// access. The directory will be returned as an empty file, so check for that as well.\n\tvar isEmptyFile bool\n\torigErr := DownloadFile(ctx, containerClient, artifact.Azure.Blob, path)\n\tif origErr == nil {\n\t\tfileInfo, lstatErr := os.Lstat(path)\n\t\tif lstatErr != nil {\n\t\t\treturn fmt.Errorf(\"unable to retrieve stats for downloaded file %s: %w\", path, lstatErr)\n\t\t}\n\n\t\t// Empty file means it could be an ADLS Gen 2 account and we downloaded the\n\t\t// directory as an empty file -- we'll check below. If it's a non-empty file,","sourceCodeStart":99,"sourceCodeEnd":135,"githubUrl":"https://github.com/argoproj/argo-workflows/blob/35bff19146f5a6ada77468c431f2624bd577e373/workflow/artifacts/azure/azure.go#L99-L135","documentation":"Load wraps any failure from newAzureContainerClient (endpoint parse, credential creation, missing account key, shared-key failure) with this message while downloading an Azure artifact. It is an aggregator: the interesting cause is always after ': %w'.","triggerScenarios":"Any of errors 403–407 occurring during a Load call: bad endpoint URL, no usable SDK credential, empty accountKey with useSDKCreds false, invalid shared key, or undeterminable account name.","commonSituations":"First artifact download of a workflow fails because the artifactRepository azure config secret is missing fields or the pod lacks identity bindings.","solutions":["Read the wrapped cause in the message and fix the underlying configuration (see endpoint/credential/account-key errors).","Validate the azure artifactRepository configmap and referenced secret before submitting workflows.","If using SDK creds, confirm the executor pod has workload identity annotations/labels attached."],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":"// validate azure config once before submitting:\n// endpoint parses as URL AND (useSDKCreds true with identity bound OR accountKeySecret present)","typeGuard":null,"tryCatchPattern":"err := driver.Load(ctx, artifact, path)\nif err != nil {\n\tif strings.Contains(err.Error(), \"unable to create Azure Blob Container client\") {\n\t\treturn fmt.Errorf(\"fix azure storage config (endpoint/credentials/accountKey): %w\", err)\n\t}\n\treturn err\n}","preventionTips":["Run a one-shot azure artifact smoke test after any config/identity change.","Keep the wrapped cause — log the full error, never just the first line.","Guard config with schema validation (endpoint URL + credential field presence)."],"tags":["azure","client-initialization","configuration"],"backgroundTag":"azure-client-creation-failed","analyzedSha":"35bff19146f5a6ada77468c431f2624bd577e373","analyzedAt":"2026-09-03T19:34:35.908Z","contentChangedAt":"2026-09-03T19:34:35.908Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}