conductor-oss/conductor · error · NonTransientException

Error communicating with Azure

Error message

Error communicating with Azure

What it means

Thrown by AzureBlobPayloadStorage.getLocation when a BlobStorageException occurs while generating a pre-signed blob URL / SAS token for an upload or download location. BlobStorageException is raised by the Azure SDK for HTTP-level failures from the Storage service (auth errors, missing container, throttling). It is wrapped in a NonTransientException, meaning the caller is not expected to retry.

Source

Thrown at azureblob-storage/src/main/java/com/netflix/conductor/azureblob/storage/AzureBlobPayloadStorage.java:144

                    blobSASPermission.setReadPermission(true);
                } else if (operation.equals(Operation.WRITE)) {
                    blobSASPermission.setWritePermission(true);
                    blobSASPermission.setCreatePermission(true);
                }
                BlobServiceSasSignatureValues blobServiceSasSignatureValues =
                        new BlobServiceSasSignatureValues(
                                OffsetDateTime.now(ZoneOffset.UTC).plusSeconds(expirationSec),
                                blobSASPermission);
                blobUrl =
                        blobUrl + "?" + blockBlobClient.generateSas(blobServiceSasSignatureValues);
            }

            externalStorageLocation.setUri(blobUrl);
            return externalStorageLocation;
        } catch (BlobStorageException e) {
            String msg = "Error communicating with Azure";
            LOGGER.error(msg, e);
            throw new NonTransientException(msg, e);
        }
    }

    /**
     * Uploads the payload to the given azure blob name. It is expected that the caller retrieves
     * the blob name using {@link #getLocation(Operation, PayloadType, String)} before making this
     * call.
     *
     * @param path the name of the blob to be uploaded
     * @param payload an {@link InputStream} containing the json payload which is to be uploaded
     * @param payloadSize the size of the json payload in bytes
     */
    @Override
    public void upload(String path, InputStream payload, long payloadSize) {
        try {
            BlockBlobClient blockBlobClient =
                    blobContainerClient.getBlobClient(path).getBlockBlobClient();
            BlobHttpHeaders blobHttpHeaders = new BlobHttpHeaders().setContentType(CONTENT_TYPE);

View on GitHub (pinned to cf7c3e4a8a)

Solutions

1. Check the logged BlobStorageException status code: 403 = bad/expired key or SAS; 404 = wrong container name; 503/429 = throttling.
2. Verify the storage account key or SAS token in the connection string is current and not expired.
3. Confirm the configured containerName exists in the storage account (create it if missing).
4. Ensure the runtime has network access to the Azure Storage endpoint from the Conductor host/container.

Example fix

// before
String msg = "Error communicating with Azure";
LOGGER.error(msg, e);
throw new NonTransientException(msg, e);

// after (surface the status code so callers can act on it)
String msg = String.format("Error communicating with Azure (HTTP %d)", e.getStatusCode());
LOGGER.error(msg, e);
throw new NonTransientException(msg, e);

// Validate container name format and that endpoint/connectionString is set before getLocation
if (isBlank(containerName)) throw new IllegalArgumentException("containerName required");
if (isBlank(connectionString) && isBlank(endpoint)) throw new IllegalArgumentException("endpoint or connectionString required");

try {
    ExternalStorageLocation loc = storage.getLocation(op, type, name);
} catch (NonTransientException e) {
    Throwable cause = e.getCause();
    if (cause instanceof BlobStorageException bse) {
        log.error("Azure getLocation failed HTTP {}", bse.getStatusCode());
    }
    throw e;
}

When it happens

Trigger: Calling getLocation(Operation, PayloadType, String) when the blobContainerClient cannot reach or authenticate to Azure, the configured containerName does not exist, or generateSas fails because the client has no shared key / SAS to sign with.

Common situations: Using a connection string with a malformed/rotated account key. The container name configured does not exist in the storage account. Network egress blocked to *.blob.core.windows.net. SAS token expired between config and use.

Related errors

• Missing property for connectionString OR endpoint
• OAuth token request failed: HTTP {code}
• A2A stream to {endpoint} failed: {message}
• A2A call '{method}' to {endpoint} failed: {message}
• Failed to acquire OAuth token from {tokenEndpointUrl}

AI-assisted analysis of conductor-oss/conductor@cf7c3e4a8a (2026-08-14). Data as JSON: /api/errors/8d40d6fb7e8bd83c. Report an issue: GitHub.