{"record":{"id":"cf6ab7a4f6a3bf9a","repo":"argoproj/argo-workflows","slug":"failed-to-obtain-a-credential-w","errorCode":null,"errorMessage":"failed to obtain a credential: %w","messagePattern":"failed to obtain a credential: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"critical","filePath":"util/sqldb/azure_auth.go","lineNumber":22,"sourceCode":"\t\"context\"\n\t\"database/sql/driver\"\n\t\"fmt\"\n\t\"strings\"\n\n\t\"github.com/Azure/azure-sdk-for-go/sdk/azcore/policy\"\n\t\"github.com/Azure/azure-sdk-for-go/sdk/azidentity\"\n\t\"github.com/lib/pq\"\n)\n\ntype azureConnector struct {\n\tdsn   string\n\tscope string\n}\n\nfunc (c *azureConnector) Connect(ctx context.Context) (driver.Conn, error) {\n\tcred, err := azidentity.NewDefaultAzureCredential(nil)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"failed to obtain a credential: %w\", err)\n\t}\n\n\ttoken, err := cred.GetToken(ctx, policy.TokenRequestOptions{Scopes: []string{c.scope}})\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"failed to get token: %w\", err)\n\t}\n\n\t// Escape single quotes in token just in case\n\tescapedToken := strings.ReplaceAll(token.Token, \"'\", \"\\\\'\")\n\n\t// Append password to DSN\n\tdsnWithPassword := fmt.Sprintf(\"%s password='%s'\", c.dsn, escapedToken)\n\n\treturn pq.Driver{}.Open(dsnWithPassword)\n}\n\nfunc (c *azureConnector) Driver() driver.Driver {\n\treturn pq.Driver{}","sourceCodeStart":4,"sourceCodeEnd":40,"githubUrl":"https://github.com/argoproj/argo-workflows/blob/35bff19146f5a6ada77468c431f2624bd577e373/util/sqldb/azure_auth.go#L4-L40","documentation":"azureConnector.Connect obtains an Azure credential chain via azidentity.NewDefaultAzureCredential (environment, workload identity, managed identity, Azure CLI, etc.). If none of the credential types in the chain can be constructed, Connect wraps the azidentity error with \"failed to obtain a credential\". It means no Azure authentication source is available to the process at all.","triggerScenarios":"Calling Connect on azureConnector when NewDefaultAzureCredential(nil) fails: AZURE_TENANT_ID/AZURE_CLIENT_ID/AZURE_CLIENT_CERTIFICATE_PATH or client secret env vars are partially/inconsistently set, workload identity env vars missing (AZURE_FEDERATED_TOKEN_FILE, AZURE_AUTHORITY_HOST), and managed identity / CLI credentials are unavailable in the environment.","commonSituations":"Running Argo locally outside Azure with no az login; pod without the azure workload-identity labels/annotation or missing the projected federated token file; AZURE_CLIENT_ID set without AZURE_TENANT_ID; upgrading azidentity changes which chain members are attempted.","solutions":["Configure workload identity: add the azure.workload.identity/use label and azure-client-id/tenant-id annotations to the pod, ensuring AZURE_FEDERATED_TOKEN_FILE and AZURE_AUTHORITY_HOST are injected.","Alternatively set the full environment credential trio consistently: AZURE_TENANT_ID, AZURE_CLIENT_ID, and either AZURE_CLIENT_SECRET or AZURE_CLIENT_CERTIFICATE_PATH.","For local dev, run `az login` so the Azure CLI credential in the chain succeeds.","If only managed identity should be used, ensure the pod/VM runs on Azure infrastructure with that identity assigned.","Read the wrapped azidentity error — it lists which credential in the chain failed and why."],"exampleFix":"// before (incomplete env)\nAZURE_CLIENT_ID=xxx  // tenant missing\n// after\nAZURE_TENANT_ID=<tenant-id>\nAZURE_CLIENT_ID=<client-id>\nAZURE_FEDERATED_TOKEN_FILE=/var/run/secrets/azure/tokens/azure-identity-token","handlingStrategy":"validation","validationCode":"required := []string{\"AZURE_TENANT_ID\", \"AZURE_CLIENT_ID\"}\nfor _, k := range required {\n    if os.Getenv(k) == \"\" && os.Getenv(\"AZURE_FEDERATED_TOKEN_FILE\") == \"\" {\n        return fmt.Errorf(\"%s missing and no workload identity configured\", k)\n    }\n}","typeGuard":null,"tryCatchPattern":"if err != nil {\n    if strings.Contains(err.Error(), \"failed to obtain a credential\") {\n        // credential chain empty: fix env/identity, don't retry\n        return fmt.Errorf(\"azure credential chain unavailable: %w\", err)\n    }\n}","preventionTips":["Label pods with azure.workload.identity/use: \"true\" and correct client-id annotations.","For local dev, always `az login` with the right subscription/tenant.","Verify federated identity credential exists in Azure for the managed identity.","Document which azidentity chain members your environment relies on."],"tags":["azure","authentication","database","config"],"backgroundTag":"azure-credential-chain-failed","analyzedSha":"35bff19146f5a6ada77468c431f2624bd577e373","analyzedAt":"2026-09-03T19:34:35.908Z","contentChangedAt":"2026-09-03T19:34:35.908Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}