kubernetes/kops · error

Azure storage account is not set on path %q

Error message

Azure storage account is not set on path %q

What it means

RenderTerraform refuses to render an azurerm_storage_blob resource when the AzureBlobPath has no storage account configured (p.account == ""). The account name is needed to build the blob's storage container ID, so an empty account is treated as a configuration error and rendering aborts with the path quoted for diagnosis.

Source

Thrown at util/pkg/vfs/azureblob_terraform.go:43

type terraformAzureBlobFile struct {
	Name               string                   `cty:"name"`
	StorageContainerID string                   `cty:"storage_container_id"`
	Type               string                   `cty:"type"`
	Source             *terraformWriter.Literal `cty:"source"`
	Provider           *terraformWriter.Literal `cty:"provider"`
}

func (p *AzureBlobPath) RenderTerraform(w *terraformWriter.TerraformWriter, name string, data io.Reader, acl ACL) error {
	bytes, err := io.ReadAll(data)
	if err != nil {
		return fmt.Errorf("reading data: %w", err)
	}

	w.EnsureTerraformProvider("azurerm", map[string]string{})

	if p.account == "" {
		return fmt.Errorf("Azure storage account is not set on path %q", p.Path())
	}
	if w.AzureStorageAccountID == "" {
		return fmt.Errorf("Azure storage account ID is not set; it is required to render blob %q", p.Path())
	}

	source, err := w.AddFilePath("azurerm_storage_blob", name, "source", bytes, false)
	if err != nil {
		return fmt.Errorf("rendering Azure Blob file: %w", err)
	}

	tf := &terraformAzureBlobFile{
		Name:               p.key,
		StorageContainerID: w.AzureStorageAccountID + "/blobServices/default/containers/" + p.container,
		Type:               "Block",
		Source:             source,
		Provider:           terraformWriter.LiteralTokens("azurerm", "files"),
	}
	return w.RenderResource("azurerm_storage_blob", name, tf)

View on GitHub (pinned to 4c8573c808)

Solutions

1. Set the Azure storage account in the cluster spec (kops create/set Cluster.Spec.ConfigStore or azure config) so the path is built with a valid account
2. Recreate the AzureBlobPath with a non-empty account name argument
3. Check the value with p.Path() or the config that produced it to confirm the account is empty
4. Re-run kops update cluster --target=terraform after fixing config

Example fix

// before
path := vfs.NewAzureBlobPath("", container, key)

// after
account := os.Getenv("AZURE_STORAGE_ACCOUNT")
if account == "" {
	return fmt.Errorf("AZURE_STORAGE_ACCOUNT must be set")
}
path := vfs.NewAzureBlobPath(account, container, key)

if p.Account() == "" {
	return fmt.Errorf("Azure storage account must be configured before rendering blob %s", p.Path())
}

if err := p.RenderTerraform(w, name, data, acl); err != nil {
	if strings.Contains(err.Error(), "storage account is not set") {
		return fmt.Errorf("cluster Azure storage account config missing; set it via `kops set cluster` : %w", err)
	}
	return err
}

When it happens

Trigger: Calling RenderTerraform on an *AzureBlobPath constructed without an Azure storage account name — e.g. NewAzureBlobPath (or equivalent) was given an empty account, or the account was never set from cluster config, then `kops update cluster --target=terraform` renders the blob.

Common situations: Cluster spec missing Azure storage account settings (azure storageAccount fields not populated); environment variable / cloud config for the Azure subscription absent; creating a VFS path manually for tests without setting the account.

Understand the failure class

Background: "missing required config value" errors: why libraries refuse to start when a configuration key is empty, unset, or blank — this error's family across 48 libraries.

Related errors

• Azure storage account ID is not set; it is required to rende
• expected azureblob:// ConfigStore.Base for Azure cluster, go
• reading data: %w
• rendering Azure Blob file: %w
• no storage account specified in %q; expected azureblob://<ac

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/42a41f6d312d3e38. Report an issue: GitHub.