kubernetes/kops · error

--azure-subscription-id is required

Error message

--azure-subscription-id is required

What it means

When the Azure feature flag is enabled and the chosen cloud provider is 'azure', RunCreateCluster requires an Azure subscription ID; missing it fails with '--azure-subscription-id is required'. This is an explicit provider-specific precondition check before cluster creation.

Source

Thrown at cmd/kops/create_cluster.go:585

			if apierrors.IsNotFound(err) {
				cluster = nil
			} else {
				return err
			}
		}

		if cluster != nil {
			return fmt.Errorf("cluster %q already exists; use 'kops update cluster' to apply changes", c.ClusterName)
		}
	}

	if c.OpenstackNetworkID != "" {
		c.NetworkID = c.OpenstackNetworkID
	}

	if featureflag.Azure.Enabled() {
		if c.CloudProvider == "azure" && c.AzureSubscriptionID == "" {
			return fmt.Errorf("--azure-subscription-id is required")
		}
	}

	clusterResult, err := cloudup.NewCluster(&c.NewClusterOptions, clientset)
	if err != nil {
		return err
	}

	cluster := clusterResult.Cluster
	instanceGroups := clusterResult.InstanceGroups

	var controlPlanes []*api.InstanceGroup
	var nodes []*api.InstanceGroup
	for _, ig := range instanceGroups {
		switch {
		case ig.Spec.Role.HasControlPlane():
			controlPlanes = append(controlPlanes, ig)
		case ig.Spec.Role.HasNode():

View on GitHub (pinned to 4c8573c808)

Solutions

1. Pass --azure-subscription-id <id> to create cluster
2. Set the AZURE_SUBSCRIPTION_ID environment variable (picked up by the flag default)
3. Disable the Azure feature flag if not intentionally targeting Azure
4. Verify the subscription ID is a valid GUID from `az account show`

Example fix

// before
KOPS_FEATURE_FLAGS=Azure kops create cluster ... --cloud azure
// after
KOPS_FEATURE_FLAGS=Azure kops create cluster ... --cloud azure --azure-subscription-id 00000000-0000-0000-0000-000000000000

if cloudProvider == "azure" && azureSubscriptionID == "" {
	azureSubscriptionID = os.Getenv("AZURE_SUBSCRIPTION_ID")
}
if cloudProvider == "azure" && azureSubscriptionID == "" {
	return fmt.Errorf("azure requires --azure-subscription-id")
}

When it happens

Trigger: Running `kops create cluster --cloud azure` (with KOPS_FEATURE_FLAGS=Azure) without --azure-subscription-id, leaving c.AzureSubscriptionID empty.

Common situations: Testing Azure support without exporting AZURE_SUBSCRIPTION_ID; copying AWS/GCP command lines to Azure; feature flag enabled in CI but Azure options not passed.

Understand the failure class

Background: "--flag is required" and "must specify" CLI errors: how missing-required-flag validation works and how to fix it — this error's family across 20 libraries.

Related errors

• at least one channel URL is required
• spec.PublicKey is required
• unable to execute --dry-run without setting --output
• --name is required
• validation of the full cluster and instance group specs fail

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/21e18d7f0b01554e. Report an issue: GitHub.