{"record":{"id":"e3cc6c7bba7a6dc8","repo":"juicedata/juicefs","slug":"failed-to-create-azure-credential-managed-identit","errorCode":null,"errorMessage":"Failed to create Azure credential (managed identity/Azure CLI): %v","messagePattern":"Failed to create Azure credential \\(managed identity/Azure CLI\\): (.+?)","errorType":"error_code","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/object/azure.go","lineNumber":352,"sourceCode":"\t\t\tif domain == \"\" {\n\t\t\t\tvar err error\n\t\t\t\tif domain, err = autoWasbEndpoint(accountName, uri.Scheme, func(serviceURL string) (*azblob.Client, error) {\n\t\t\t\t\treturn azblob.NewClientWithNoCredential(serviceURL+\"?\"+normalized, nil)\n\t\t\t\t}); err != nil {\n\t\t\t\t\treturn nil, fmt.Errorf(\"Unable to get endpoint of container %s: %s\", containerName, err)\n\t\t\t\t}\n\t\t\t}\n\t\t\tsasURL := fmt.Sprintf(\"%s://%s.%s?%s\", uri.Scheme, accountName, domain, normalized)\n\t\t\tclient, err := azblob.NewClientWithNoCredential(sasURL, azblobOptions())\n\t\t\tif err != nil {\n\t\t\t\treturn nil, fmt.Errorf(\"Failed to create Azure blob client with SAS token: %v\", err)\n\t\t\t}\n\t\t\treturn &wasb{container: client.ServiceClient().NewContainerClient(containerName), azblobCli: client, cName: containerName, useTokenAuth: true}, nil\n\t\t}\n\n\t\ttokenCred, err := createAzureCredential()\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"Failed to create Azure credential (managed identity/Azure CLI): %v\", err)\n\t\t}\n\t\tif domain == \"\" {\n\t\t\tif domain, err = autoWasbEndpoint(accountName, uri.Scheme, func(serviceURL string) (*azblob.Client, error) {\n\t\t\t\treturn azblob.NewClient(serviceURL, tokenCred, nil)\n\t\t\t}); err != nil {\n\t\t\t\treturn nil, fmt.Errorf(\"Unable to get endpoint of container %s: %s\", containerName, err)\n\t\t\t}\n\t\t}\n\t\tserviceURL := fmt.Sprintf(\"%s://%s.%s\", uri.Scheme, accountName, domain)\n\t\tclient, err := azblob.NewClient(serviceURL, tokenCred, azblobOptions())\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"Failed to create Azure blob client with token credential: %v\", err)\n\t\t}\n\t\treturn &wasb{container: client.ServiceClient().NewContainerClient(containerName), azblobCli: client, cName: containerName, useTokenAuth: true}, nil\n\t}\n\n\t// Priority 3: Shared key authentication\n\tcredential, err := azblob.NewSharedKeyCredential(accountName, accountKey)","sourceCodeStart":334,"sourceCodeEnd":370,"githubUrl":"https://github.com/juicedata/juicefs/blob/c9a67b23e8e08ec23ec331aa6f1675e2319e921c/pkg/object/azure.go#L334-L370","documentation":"Thrown when createAzureCredential fails to build any DefaultAzureCredential-style token credential (managed identity or Azure CLI) for token-based auth to Azure Blob Storage. It means no usable Azure identity exists in the execution environment.","triggerScenarios":"newWasb called without SAS token and without account key, so the code falls back to token credential via createAzureCredential(), which fails (az CLI not installed/logged in, no managed identity on the VM, MSI endpoint unreachable).","commonSituations":"Running locally without 'az login'; running in a VM/container without a managed identity; AZURE_CLIENT_ID set to a non-existent identity; offline/air-gapped environment.","solutions":["Run 'az login' if using Azure CLI auth locally.","Enable a system-assigned or user-assigned managed identity on the VM/container, or set AZURE_CLIENT_ID/AZURE_TENANT_ID/AZURE_CLIENT_SECRET.","Provide an account key or SAS token instead so token credential is not needed.","Verify network access to the IMDS/MSI endpoint (169.254.169.254)."],"exampleFix":"// before\njuicefs mount azblob://myaccount /mnt/jfs   (no key, no login)\n// after\naz login\njuicefs mount azblob://myaccount /mnt/jfs\n# or\njuicefs mount azblob://myaccount /mnt/jfs --storage-args key=ACCOUNTKEY","handlingStrategy":"fallback","validationCode":"if os.Getenv(\"AZURE_CLIENT_ID\") == \"\" {\n    if _, err := exec.LookPath(\"az\"); err != nil { return errors.New(\"no managed identity and az CLI not available\") }\n}","typeGuard":null,"tryCatchPattern":"cred, err := createAzureCredential()\nif err != nil {\n    return fmt.Errorf(\"no Azure identity available (managed identity/AzCLI): %w; provide an account key instead\", err)\n}","preventionTips":["Run 'az login' before local runs","Provision a managed identity on VMs/containers","Prefer explicit account key or SAS token in automated environments","Check IMDS (169.254.169.254) reachability in cloud deployments"],"tags":["azure","authentication","managed-identity","credentials"],"backgroundTag":"missing-credentials","analyzedSha":"c9a67b23e8e08ec23ec331aa6f1675e2319e921c","analyzedAt":"2026-09-06T17:55:48.476Z","contentChangedAt":"2026-09-06T17:55:48.476Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}