argoproj/argo-workflows · error

unable to create default Azure credential: %w

Error message

unable to create default Azure credential: %w

What it means

When UseSDKCreds is true, the driver builds an azidentity.NewDefaultAzureCredential chain (environment, managed identity, Azure CLI, etc.); if the chained credential cannot be constructed, this wrapped error is returned.

Source

Thrown at workflow/artifacts/azure/azure.go:55

// newAzureContainerClient creates a new container.Client for interacting with the specified Azure Blob Storage container
// The container client is created with the default azblob.ClientOptions which does include retry behavior
// for failed requests.
func (azblobDriver *ArtifactDriver) newAzureContainerClient(ctx context.Context) (*container.Client, error) {
	containerURL, err := url.Parse(azblobDriver.Endpoint)
	if err != nil {
		return nil, fmt.Errorf("unable to parse Azure Blob Storage endpoint url %s: %w", azblobDriver.Endpoint, err)
	}
	// Append the container name to the URL path
	if len(containerURL.Path) == 0 || containerURL.Path[len(containerURL.Path)-1] != '/' {
		containerURL.Path += "/"
	}
	containerURL.Path += azblobDriver.Container

	if azblobDriver.UseSDKCreds {
		credential, credErr := azidentity.NewDefaultAzureCredential(nil)
		if credErr != nil {
			return nil, fmt.Errorf("unable to create default Azure credential: %w", credErr)
		}
		containerClient, clientErr := container.NewClient(containerURL.String(), credential, nil)
		return containerClient, clientErr
	}
	if azblobDriver.AccountKey == "" {
		return nil, fmt.Errorf("accountKey secret is required for Azure Blob Storage if useSDKCreds is false")
	}

	if isSASAccountKey(azblobDriver.AccountKey) {
		logger := logging.RequireLoggerFromContext(ctx)
		logger.Info(ctx, "Provided account key is a SAS token. Using no-credential client.")
		serviceURL := fmt.Sprintf("%s?%s", containerURL.String(), azblobDriver.AccountKey)
		containerClient, clientErr := container.NewClientWithNoCredential(serviceURL, nil)
		return containerClient, clientErr
	}

	accountName, err := determineAccountName(containerURL)
	if err != nil {

View on GitHub (pinned to 35bff19146)

Solutions

1. Configure workload identity or a managed identity on the executor pod (AKS: use workload identity federation labels).
2. Provide AZURE_TENANT_ID, AZURE_CLIENT_ID and AZURE_CLIENT_SECRET via envFrom a secret for service-principal auth.
3. If you instead use a static account key, set useSDKCreds: false and supply the accountKey secret.
4. Check the wrapped azidentity cause to see which credential in the chain was rejected.

Example fix

// before
azure:
  useSDKCreds: true
// after — ensure pod has workload identity, or fall back to account key
azure:
  accountKeySecret:
    name: azure-creds
    key: account-key

// before relying on SDK creds, confirm a credential source exists:
hasEnvSP := os.Getenv("AZURE_CLIENT_ID") != "" && os.Getenv("AZURE_TENANT_ID") != "" && os.Getenv("AZURE_CLIENT_SECRET") != ""
// otherwise attach workload identity or use accountKeySecret

credential, credErr := azidentity.NewDefaultAzureCredential(nil)
if credErr != nil {
	logger.Error(ctx, "no Azure credential chain available; falling back to accountKeySecret")
	return useAccountKeyFlow(ctx)
}

When it happens

Trigger: useSDKCreds: true is set but the pod environment provides no credential source: missing AZURE_TENANT_ID/AZURE_CLIENT_ID/AZURE_CLIENT_SECRET, no managed identity / workload identity binding on the pod, and no Azure CLI login available.

Common situations: Running the workflow pod without workload-identity labels/annotations in AKS; forgot to mount service-principal env vars from a secret; local dev without az login when testing Azurite against SDK creds.

Related errors

• failed to obtain a credential: %w
• failed to get token: %w
• unable to create Azure shared key credential: %w
• unable to download blob %s: %w
• --client-certificate and --client-key must be provided toget

AI-assisted analysis of argoproj/argo-workflows@35bff19146 (2026-09-03). Data as JSON: /api/errors/8acd67a5c1878769. Report an issue: GitHub.