accountKey secret is required for Azure Blob Storage if useS

Error message

accountKey secret is required for Azure Blob Storage if useSDKCreds is false

What it means

The Azure driver requires either SDK-based credentials (UseSDKCreds) or a static account key; when useSDKCreds is false/absent and AccountKey is empty, newAzureContainerClient fails fast with this message.

Source

Thrown at workflow/artifacts/azure/azure.go:61

	if err != nil {
		return nil, fmt.Errorf("unable to parse Azure Blob Storage endpoint url %s: %w", azblobDriver.Endpoint, err)
	}
	// Append the container name to the URL path
	if len(containerURL.Path) == 0 || containerURL.Path[len(containerURL.Path)-1] != '/' {
		containerURL.Path += "/"
	}
	containerURL.Path += azblobDriver.Container

	if azblobDriver.UseSDKCreds {
		credential, credErr := azidentity.NewDefaultAzureCredential(nil)
		if credErr != nil {
			return nil, fmt.Errorf("unable to create default Azure credential: %w", credErr)
		}
		containerClient, clientErr := container.NewClient(containerURL.String(), credential, nil)
		return containerClient, clientErr
	}
	if azblobDriver.AccountKey == "" {
		return nil, fmt.Errorf("accountKey secret is required for Azure Blob Storage if useSDKCreds is false")
	}

	if isSASAccountKey(azblobDriver.AccountKey) {
		logger := logging.RequireLoggerFromContext(ctx)
		logger.Info(ctx, "Provided account key is a SAS token. Using no-credential client.")
		serviceURL := fmt.Sprintf("%s?%s", containerURL.String(), azblobDriver.AccountKey)
		containerClient, clientErr := container.NewClientWithNoCredential(serviceURL, nil)
		return containerClient, clientErr
	}

	accountName, err := determineAccountName(containerURL)
	if err != nil {
		return nil, err
	}
	credential, err := azblob.NewSharedKeyCredential(accountName, azblobDriver.AccountKey)
	if err != nil {
		return nil, fmt.Errorf("unable to create Azure shared key credential: %w", err)
	}

View on GitHub (pinned to 35bff19146)

Solutions

Add an accountKeySecret to the azure storage config (name + key of a k8s secret holding the storage account key).
Or set useSDKCreds: true and provide workload identity / service principal credentials.
Verify the secret exists in the controller's namespace and its key matches the config (kubectl get secret <name> -o jsonpath='{.data.<key>}').

Example fix

// before — artifactRepository config
azure:
  endpoint: https://acct.blob.core.windows.net
  container: my-container
// after
azure:
  endpoint: https://acct.blob.core.windows.net
  container: my-container
  accountKeySecret:
    name: azure-storage-creds
    key: account-key

Defensive patterns

Strategy: validation

Validate before calling

func azureConfigComplete(cfg AzureConfig, cs kubernetes.Interface, ns string) error {
	if cfg.UseSDKCreds { return nil }
	if cfg.AccountKeySecret == nil { return fmt.Errorf("azure: set useSDKCreds: true or provide accountKeySecret") }
	_, err := cs.CoreV1().Secrets(ns).Get(ctx, cfg.AccountKeySecret.Name, metav1.GetOptions{})
	return err
}

Prevention

Always pair an azure storage config with either useSDKCreds: true or accountKeySecret.
Create the accountKey secret in the same namespace as the controller before applying the configmap.
Assert secret key names match the config in your deploy pipeline.

When it happens

Trigger: Azure artifact storage config omits useSDKCreds (defaults false) and no accountKey/accountKeySecret is provided, or the referenced secret key resolves to an empty string.

Common situations: Switched to SDK creds but forgot to set useSDKCreds: true; secret key name mismatch so GetSecret returned empty; artifact repository configmap references a secret that was never created.

Related errors

AI-assisted analysis of argoproj/argo-workflows@35bff19146 (2026-09-03). Data as JSON: /api/errors/abc35dc3e4242c6a. Report an issue: GitHub.