{"record":{"id":"f1854e36d137b3a7","repo":"getsops/sops","slug":"failed-to-construct-azure-key-vault-client-to-retr","errorCode":null,"errorMessage":"failed to construct Azure Key Vault client to retrieve key version: %w","messagePattern":"failed to construct Azure Key Vault client to retrieve key version: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"azkv/keysource.go","lineNumber":189,"sourceCode":"}\n\nfunc (key *MasterKey) ensureKeyHasVersion(ctx context.Context) error {\n\tif key.Version != \"\" {\n\t\t// Nothing to do\n\t\treturn nil\n\t}\n\n\ttoken, err := key.getTokenCredential()\n\n\tif err != nil {\n\t\tlog.WithFields(logrus.Fields{\"key\": key.Name, \"version\": key.Version}).Info(\"Encryption failed\")\n\t\treturn fmt.Errorf(\"failed to get Azure token credential to retrieve key version: %w\", err)\n\t}\n\n\tc, err := azkeys.NewClient(key.VaultURL, token, key.clientOptions)\n\tif err != nil {\n\t\tlog.WithFields(logrus.Fields{\"key\": key.Name, \"version\": key.Version}).Info(\"Encryption failed\")\n\t\treturn fmt.Errorf(\"failed to construct Azure Key Vault client to retrieve key version: %w\", err)\n\t}\n\n\tkdetail, err := c.GetKey(ctx, key.Name, key.Version, nil)\n\tif err != nil {\n\t\tlog.WithFields(logrus.Fields{\"key\": key.Name, \"version\": key.Version}).Info(\"Encryption failed\")\n\t\treturn fmt.Errorf(\"failed to fetch Azure Key to retrieve key version: %w\", err)\n\t}\n\tkey.Version = kdetail.Key.KID.Version()\n\n\tlog.WithFields(logrus.Fields{\"key\": key.Name, \"version\": key.Version}).Info(\"Version fetch succeeded\")\n\treturn nil\n}\n\n// EncryptContext takes a SOPS data key, encrypts it with Azure Key Vault, and stores\n// the result in the EncryptedKey field.\nfunc (key *MasterKey) EncryptContext(ctx context.Context, dataKey []byte) error {\n\ttoken, err := key.getTokenCredential()\n\tif err != nil {","sourceCodeStart":171,"sourceCodeEnd":207,"githubUrl":"https://github.com/getsops/sops/blob/13442bb98183887d7a9ac09ec8ab0564673a59d8/azkv/keysource.go#L171-L207","documentation":"After obtaining a token credential, ensureKeyHasVersion builds an azkeys client to query the key. This error means azkeys.NewClient rejected the arguments — usually because key.VaultURL is malformed or empty.","triggerScenarios":"ensureKeyHasVersion calls azkeys.NewClient(key.VaultURL, token, key.clientOptions) and the SDK returns an error, typically an invalid vault URL (not an absolute https URL) passed via the key URL or sops config.","commonSituations":"Vault URL missing https:// scheme; empty vault URL after a bad parse; trailing characters or a host-only value without scheme; corporate proxy altering the endpoint configuration.","solutions":["Check that the vault URL in the key identifier is a full https URL like https://myvault.vault.azure.net","Print/inspect the key's VaultURL value before client construction (log or debug)","Re-enter the key URL in .sops.yaml without typos or line breaks","Upgrade the Azure SDK modules if the error persists with a clearly valid URL"],"exampleFix":"// before\nazure_kv: myvault.vault.azure.net/keys/k1\n// after\nazure_kv: https://myvault.vault.azure.net/keys/k1","handlingStrategy":"validation","validationCode":"u, err := url.Parse(key.VaultURL)\nif err != nil || u.Scheme != \"https\" || u.Host == \"\" {\n    return fmt.Errorf(\"invalid vault URL %q: must be an absolute https URL\", key.VaultURL)\n}","typeGuard":"func isValidVaultURL(vaultURL string) bool {\n    u, err := url.Parse(vaultURL)\n    return err == nil && u.Scheme == \"https\" && u.Host != \"\"\n}","tryCatchPattern":"err := ensureVersion(key)\nif strings.Contains(err.Error(), \"failed to construct Azure Key Vault client\") {\n    return fmt.Errorf(\"check the vault URL in the key identifier: %w\", err)\n}","preventionTips":["Always use full https vault URLs in azure_kv entries","Avoid hand-editing key metadata in .sops.yaml","Validate URLs with a regex/url.Parse before storing"],"tags":["azure","key-vault","client-construction","url-validation"],"backgroundTag":"invalid-key-vault-url","analyzedSha":"13442bb98183887d7a9ac09ec8ab0564673a59d8","analyzedAt":"2026-09-01T03:53:00.447Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}