kubernetes/kops · error

downloading nodeup from an azureblob:// URL is not supported

Error message

downloading nodeup from an azureblob:// URL is not supported in Azure environment %q

What it means

The generated nodeup script hard-codes the public Azure cloud blob endpoint suffix (blob.core.windows.net). Build therefore rejects azureblob:// downloads when AZURE_ENVIRONMENT names a non-public cloud, since nodeup would otherwise download from the wrong endpoint and fail at boot time.

Source

Thrown at pkg/model/resources/nodeup.go:326

}

func (b *NodeUpScript) Build() (fi.Resource, error) {
	if b.ProxyEnv == nil {
		b.ProxyEnv = funcEmptyString
	}
	if b.EnvironmentVariables == nil {
		b.EnvironmentVariables = funcEmptyString
	}

	if b.useS3Download() && b.S3Region == "" {
		return nil, fmt.Errorf("ResolveS3Region must be called before building a nodeup script with an s3:// source")
	}

	if b.useBlobDownload() {
		// The script hard-codes the public cloud blob.core.windows.net endpoint suffix.
		// Azure environment names are case-insensitive; AzureCloud is the CLI name of the public cloud.
		if azureEnv := os.Getenv("AZURE_ENVIRONMENT"); azureEnv != "" && !strings.EqualFold(azureEnv, "AzurePublicCloud") && !strings.EqualFold(azureEnv, "AzureCloud") {
			return nil, fmt.Errorf("downloading nodeup from an azureblob:// URL is not supported in Azure environment %q", azureEnv)
		}
	}

	functions := template.FuncMap{
		"NodeUpSourceAmd64": func() (string, error) {
			return b.nodeUpSource(architectures.ArchitectureAmd64)
		},
		"NodeUpSourceHashAmd64": func() string {
			if b.NodeUpAssets[architectures.ArchitectureAmd64] != nil {
				return b.NodeUpAssets[architectures.ArchitectureAmd64].Hash.Hex()
			}
			return ""
		},
		"NodeUpSourceArm64": func() (string, error) {
			return b.nodeUpSource(architectures.ArchitectureArm64)
		},
		"NodeUpSourceHashArm64": func() string {
			if b.NodeUpAssets[architectures.ArchitectureArm64] != nil {

View on GitHub (pinned to 4c8573c808)

Solutions

1. Unset AZURE_ENVIRONMENT or set it to AzurePublicCloud/AzureCloud when targeting public Azure.
2. If you genuinely target a sovereign cloud, do not use azureblob:// nodeup sources — switch to another source scheme.
3. Check `echo $AZURE_ENVIRONMENT` in the environment running kops.
4. Adjust CI job environment variables so only the intended Azure environment is configured.

Example fix

// before
export AZURE_ENVIRONMENT=AzureChinaCloud
kops update cluster ...
// after
unset AZURE_ENVIRONMENT   # or: export AZURE_ENVIRONMENT=AzurePublicCloud
kops update cluster ...

if azureEnv := os.Getenv("AZURE_ENVIRONMENT"); azureEnv != "" &&
    !strings.EqualFold(azureEnv, "AzurePublicCloud") &&
    !strings.EqualFold(azureEnv, "AzureCloud") && blobSourceInUse {
    return fmt.Errorf("%s not supported for azureblob nodeup source", azureEnv)
}

func isPublicAzureEnv() bool {
    e := os.Getenv("AZURE_ENVIRONMENT")
    return e == "" || strings.EqualFold(e, "AzurePublicCloud") || strings.EqualFold(e, "AzureCloud")
}

if err := errUnsupportedAzureEnv; err != nil {
    return fmt.Errorf("unset AZURE_ENVIRONMENT or use a non-blob nodeup source: %w", err)
}

When it happens

Trigger: Building a NodeUpScript that uses blob download while the AZURE_ENVIRONMENT environment variable is set to a sovereign cloud name such as 'AzureChinaCloud', 'AzureUSGovernment', or 'AzureGermanCloud' (any value not equal, case-insensitively, to AzurePublicCloud or AzureCloud).

Common situations: CI agents or developer shells configured for Azure China/Government stacks running kops against public cloud (or vice versa); leftover AZURE_ENVIRONMENT from az CLI tooling.

Related errors

• error querying Azure instance metadata: %v
• parsing Azure Blob location: %w
• invalid Azure Blob location; expected azureblob://<account>/
• DNS not implemented on azureCloud
• FindVPCInfo not implemented on azureCloud, use FindVNetInfo

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/e43e80211395380d. Report an issue: GitHub.