What causes "Azure storage account is required" in kubernetes/kops?

Ensure the account passed to the Azure Blob VFS path/client construction is non-empty before calling BuildVfsPath.

Azure storage account is required

Error message

Azure storage account is required

What it means

getAzureBlobClient creates/caches azblob.Client instances per storage account. It refuses to proceed when the account string is empty, because an azblob client cannot be constructed without a target account. Normally unreachable directly, since buildAzureBlobPath validates the account first, but it is a defensive guard on the client-creation path.

Source

Thrown at util/pkg/vfs/context.go:601

	account := strings.TrimSuffix(u.Host, "/")
	if account == "" {
		return nil, fmt.Errorf("no storage account specified in %q; expected azureblob://<account>/<container>/<key>", p)
	}

	rest := strings.TrimPrefix(u.Path, "/")
	container, key, _ := strings.Cut(rest, "/")
	if container == "" {
		return nil, fmt.Errorf("no container specified in %q; expected azureblob://<account>/<container>/<key>", p)
	}

	return NewAzureBlobPath(c, account, container, key), nil
}

// getAzureBlobClient returns the client for azure blob storage for the given
// storage account, caching it for future reuse.
func (c *VFSContext) getAzureBlobClient(ctx context.Context, account string) (*azblob.Client, error) {
	if account == "" {
		return nil, fmt.Errorf("Azure storage account is required")
	}

	c.mutex.Lock()
	defer c.mutex.Unlock()

	if client, ok := c.azureClients[account]; ok {
		return client, nil
	}

	client, err := newAzureClient(ctx, account)
	if err != nil {
		return nil, err
	}
	if c.azureClients == nil {
		c.azureClients = make(map[string]*azblob.Client)
	}
	c.azureClients[account] = client
	return client, nil

View on GitHub (pinned to 4c8573c808)

Solutions

Ensure the account passed to the Azure Blob VFS path/client construction is non-empty before calling BuildVfsPath.
Route construction through BuildVfsPath so buildAzureBlobPath's URL validation populates the account correctly.
Check that the azureblob:// URL host (account) is populated, since it feeds getAzureBlobClient.

Example fix

// before
client, err := ctx.getAzureBlobClient(ctx, account) // account == ""
// after
if account == "" { return fmt.Errorf("storage account must be set") }
client, err := ctx.getAzureBlobClient(ctx, account)

Defensive patterns

Strategy: validation

Validate before calling

if account == "" {
    return errors.New("Azure storage account must be configured before building the VFS path")
}

Type guard

func accountConfigured(account string) bool { return account != "" }

Prevention

Always construct Azure VFS paths via BuildVfsPath so the URL is validated first.
Fail fast at config load time if the storage account value is empty.
Do not pass account strings straight from optional config fields without a default check.

When it happens

Trigger: getClient dispatching to getAzureBlobClient with an empty account — possible only if a caller bypasses buildAzureBlobPath or passes an empty account string into the VFS Azure client factory.

Common situations: Programmatic use of the VFS Azure path/client APIs where the account argument is sourced from a config value that silently defaults to empty string.

Related errors

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/1e84220f92b6f727. Report an issue: GitHub.