juicedata/juicefs · error

Failed to create Azure credential (managed identity/Azure CL

Error message

Failed to create Azure credential (managed identity/Azure CLI): %v

What it means

Thrown when createAzureCredential fails to build any DefaultAzureCredential-style token credential (managed identity or Azure CLI) for token-based auth to Azure Blob Storage. It means no usable Azure identity exists in the execution environment.

Source

Thrown at pkg/object/azure.go:352

			if domain == "" {
				var err error
				if domain, err = autoWasbEndpoint(accountName, uri.Scheme, func(serviceURL string) (*azblob.Client, error) {
					return azblob.NewClientWithNoCredential(serviceURL+"?"+normalized, nil)
				}); err != nil {
					return nil, fmt.Errorf("Unable to get endpoint of container %s: %s", containerName, err)
				}
			}
			sasURL := fmt.Sprintf("%s://%s.%s?%s", uri.Scheme, accountName, domain, normalized)
			client, err := azblob.NewClientWithNoCredential(sasURL, azblobOptions())
			if err != nil {
				return nil, fmt.Errorf("Failed to create Azure blob client with SAS token: %v", err)
			}
			return &wasb{container: client.ServiceClient().NewContainerClient(containerName), azblobCli: client, cName: containerName, useTokenAuth: true}, nil
		}

		tokenCred, err := createAzureCredential()
		if err != nil {
			return nil, fmt.Errorf("Failed to create Azure credential (managed identity/Azure CLI): %v", err)
		}
		if domain == "" {
			if domain, err = autoWasbEndpoint(accountName, uri.Scheme, func(serviceURL string) (*azblob.Client, error) {
				return azblob.NewClient(serviceURL, tokenCred, nil)
			}); err != nil {
				return nil, fmt.Errorf("Unable to get endpoint of container %s: %s", containerName, err)
			}
		}
		serviceURL := fmt.Sprintf("%s://%s.%s", uri.Scheme, accountName, domain)
		client, err := azblob.NewClient(serviceURL, tokenCred, azblobOptions())
		if err != nil {
			return nil, fmt.Errorf("Failed to create Azure blob client with token credential: %v", err)
		}
		return &wasb{container: client.ServiceClient().NewContainerClient(containerName), azblobCli: client, cName: containerName, useTokenAuth: true}, nil
	}

	// Priority 3: Shared key authentication
	credential, err := azblob.NewSharedKeyCredential(accountName, accountKey)

View on GitHub (pinned to c9a67b23e8)

Solutions

1. Run 'az login' if using Azure CLI auth locally.
2. Enable a system-assigned or user-assigned managed identity on the VM/container, or set AZURE_CLIENT_ID/AZURE_TENANT_ID/AZURE_CLIENT_SECRET.
3. Provide an account key or SAS token instead so token credential is not needed.
4. Verify network access to the IMDS/MSI endpoint (169.254.169.254).

Example fix

// before
juicefs mount azblob://myaccount /mnt/jfs   (no key, no login)
// after
az login
juicefs mount azblob://myaccount /mnt/jfs
# or
juicefs mount azblob://myaccount /mnt/jfs --storage-args key=ACCOUNTKEY

if os.Getenv("AZURE_CLIENT_ID") == "" {
    if _, err := exec.LookPath("az"); err != nil { return errors.New("no managed identity and az CLI not available") }
}

cred, err := createAzureCredential()
if err != nil {
    return fmt.Errorf("no Azure identity available (managed identity/AzCLI): %w; provide an account key instead", err)
}

When it happens

Trigger: newWasb called without SAS token and without account key, so the code falls back to token credential via createAzureCredential(), which fails (az CLI not installed/logged in, no managed identity on the VM, MSI endpoint unreachable).

Common situations: Running locally without 'az login'; running in a VM/container without a managed identity; AZURE_CLIENT_ID set to a non-existent identity; offline/air-gapped environment.

Related errors

• create B2 client: %s
• CIFS username/ak is required
• CIFS password/sk is required
• No kerberos credential was found! Parameter "--keytab" and "
• object storage: %s

AI-assisted analysis of juicedata/juicefs@c9a67b23e8 (2026-09-06). Data as JSON: /api/errors/e3cc6c7bba7a6dc8. Report an issue: GitHub.