no storage account specified in %q; expected azureblob://<ac

Error message

no storage account specified in %q; expected azureblob://<account>/<container>/<key>

What it means

The kOps VFS layer parses Azure Blob Storage paths of the form azureblob://<account>/<container>/<key>. This error is thrown by buildAzureBlobPath when the URL has the azureblob scheme but the host portion (the storage account name) is empty. The VFS path cannot be constructed without knowing which storage account to talk to.

Source

Thrown at util/pkg/vfs/context.go:585

}

func (c *VFSContext) buildAzureBlobPath(p string) (*AzureBlobPath, error) {
	if os.Getenv("AZURE_STORAGE_ACCOUNT") != "" {
		return nil, fmt.Errorf("unset AZURE_STORAGE_ACCOUNT; the storage account belongs in the URL:  azureblob://<account>/<container>/<key>")
	}

	u, err := url.Parse(p)
	if err != nil {
		return nil, fmt.Errorf("failed to parse %q: %s", p, err)
	}

	if u.Scheme != "azureblob" {
		return nil, fmt.Errorf("invalid Azure Blob scheme: %q", p)
	}

	account := strings.TrimSuffix(u.Host, "/")
	if account == "" {
		return nil, fmt.Errorf("no storage account specified in %q; expected azureblob://<account>/<container>/<key>", p)
	}

	rest := strings.TrimPrefix(u.Path, "/")
	container, key, _ := strings.Cut(rest, "/")
	if container == "" {
		return nil, fmt.Errorf("no container specified in %q; expected azureblob://<account>/<container>/<key>", p)
	}

	return NewAzureBlobPath(c, account, container, key), nil
}

// getAzureBlobClient returns the client for azure blob storage for the given
// storage account, caching it for future reuse.
func (c *VFSContext) getAzureBlobClient(ctx context.Context, account string) (*azblob.Client, error) {
	if account == "" {
		return nil, fmt.Errorf("Azure storage account is required")
	}

View on GitHub (pinned to 4c8573c808)

Solutions

Fix the azureblob:// URL so the host is the storage account name: azureblob://<account>/<container>/<key>.
If the URL comes from an env var (KOPS_STATE_STORE) or template, verify the variable is non-empty and contains the account before invoking kops.
If using managed Azure identity config, confirm the storage account name matches the resource created in the resource group.

Example fix

// before
BuildVfsPath("azureblob:///mystorage/mycontainer/kops-config")
// after
BuildVfsPath("azureblob://mystorageaccount/mycontainer/kops-config")

Defensive patterns

Strategy: validation

Validate before calling

u, _ := url.Parse(stateStore)
if u.Scheme == "azureblob" && u.Host == "" {
    return fmt.Errorf("azureblob state store %q is missing the storage account", stateStore)
}

Type guard

func isValidAzureBlobURL(p string) bool {
    u, err := url.Parse(p)
    return err == nil && u.Scheme == "azureblob" && u.Host != ""
}

Prevention

Always use the full azureblob://<account>/<container>/<key> form in KOPS_STATE_STORE or --state-store.
Validate the state store URL at startup, before any VFS call.
Avoid shell stripping of empty variables when templating the URL.

When it happens

Trigger: Calling VFSContext.BuildVfsPath (directly or via cluster config/state store flags) with a URL like "azureblob:///container/key" or "azureblob://" — any azureblob:// URL with an empty host.

Common situations: A misconfigured --state-store or OSS/KOPS_STATE_STORE environment variable where the account name was dropped (e.g. trailing-slash stripping or a templating variable that expanded to empty), or a hand-edited cluster spec pointing at an incomplete azureblob URL.

Related errors

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/193d9c8280539f0b. Report an issue: GitHub.