cilium/cilium · error

unable to create Azure client: %w

Error message

unable to create Azure client: %w

What it means

AllocatorAzure.Start failed constructing the Azure API client via api.NewClient, which wraps the Azure SDK (compute/network interfaces) with the resolved cloud name, subscription ID, resource group, and user-assigned identity. A construction failure (bad identity ID, invalid parameters) is wrapped and aborts Azure IPAM startup.

Source

Thrown at operator/pkg/ipam/allocator/azure/azure.go:75

		}
		subscriptionID = subID
		a.logger.Debug("Detected subscriptionID via Azure IMS", logfields.SubscriptionID, subscriptionID)
	}

	resourceGroupName := a.AzureResourceGroup
	if resourceGroupName == "" {
		a.logger.Debug("ResourceGroupName was not specified via CLI, retrieving it via Azure IMS")
		rgName, err := metadata.GetResourceGroupName(ctx, a.rootLogger)
		if err != nil {
			return nil, fmt.Errorf("Azure resource group name was not specified via CLI and retrieving it from the Azure IMS was not possible: %w", err)
		}
		resourceGroupName = rgName
		a.logger.Debug("Detected resource group name via Azure IMS", logfields.Resource, resourceGroupName)
	}

	azureClient, err := api.NewClient(a.rootLogger, azureCloudName, subscriptionID, resourceGroupName, a.AzureUserAssignedIdentityID, a.AzureMetrics, a.LimitIPAMAPIQPS, a.LimitIPAMAPIBurst, a.AzureUsePrimaryAddress)
	if err != nil {
		return nil, fmt.Errorf("unable to create Azure client: %w", err)
	}
	instances := ipam.NewInstancesManager(a.rootLogger, azureClient, a.AzureUsePrimaryAddress)
	nodeManager, err := nodemanager.NewNodeManager(a.logger, instances, getterUpdater, iMetrics, a.ParallelAllocWorkers, false, 0, false)
	if err != nil {
		return nil, fmt.Errorf("unable to initialize Azure node manager: %w", err)
	}

	if err := nodeManager.Start(ctx); err != nil {
		return nil, err
	}

	return nodeManager, nil
}

View on GitHub (pinned to ac7b90affa)

Solutions

1. Read the wrapped cause in the operator log to see which client parameter failed.
2. Verify --azure-user-assigned-identity-id is the full resource ID: /subscriptions/<sub>/resourceGroups/<rg>/providers/Microsoft.ManagedIdentity/userAssignedIdentities/<name>.
3. Check --limit-ipam-api-qps and --limit-ipam-api-burst are positive numbers.
4. Validate --azure-cloud-name matches your tenant's cloud (AzurePublicCloud, AzureChinaCloud, etc.).
5. Confirm the user-assigned identity exists in the stated resource group and subscription.

Example fix

// before
args: ["--azure-user-assigned-identity-id=00000000-0000-0000-0000-000000000000"]
// after
args: ["--azure-user-assigned-identity-id=/subscriptions/<sub>/resourceGroups/<rg>/providers/Microsoft.ManagedIdentity/userAssignedIdentities/my-identity"]

if identityID != "" && !strings.HasPrefix(identityID, "/subscriptions/") { return errors.New("user-assigned identity must be a full resource ID") }

if _, err := azureAlloc.Start(ctx, gu, metrics); err != nil {
	if strings.Contains(err.Error(), "Azure client") { log.Fatalf("client construction failed: %v", err) }
	return err
}

When it happens

Trigger: api.NewClient returns an error — commonly an invalid --azure-user-assigned-identity-id (wrong resource ID format), unsupported cloud name, or misconfigured rate-limit (QPS/burst) values.

Common situations: Passing a client-ID instead of the full resource ID for the user-assigned identity; using Azure Stack/China cloud with mismatched flags; negative QPS/burst limits from config typos.

Related errors

• Azure subscription ID was not specified via CLI and retrievi
• Azure resource group name was not specified via CLI and retr
• unable to initialize Azure node manager: %w
• not a user reserved identity
• missing Azure resource group name

AI-assisted analysis of cilium/cilium@ac7b90affa (2026-08-31). Data as JSON: /api/errors/67f260d7441ead5a. Report an issue: GitHub.