What causes "rendering Azure Blob file: %w" in kubernetes/kops?

Inspect the wrapped error from AddFilePath (errors.Unwrap) for the root cause

rendering Azure Blob file

Error message

rendering Azure Blob file: %w

What it means

After validation, RenderTerraform registers the blob's file contents with the TerraformWriter via w.AddFilePath("azurerm_storage_blob", ...), which stores the content and returns the Terraform source reference. If AddFilePath fails, the error is wrapped as "rendering Azure Blob file: %w", indicating the blob resource could not be added to the generated Terraform.

Solutions

Inspect the wrapped error from AddFilePath (errors.Unwrap) for the root cause
Ensure each blob is rendered with a unique `name` to avoid duplicate Terraform resource entries
Check blob content size and validity before rendering
Recreate/reinitialize the TerraformWriter and re-run the render

Example fix

// before
w.AddFilePath("azurerm_storage_blob", name, "source", bytes, false) // name reused across blobs

// after
uniqueName := fmt.Sprintf("%s-%s", container, strings.ReplaceAll(key, "/", "-"))
if err := p.RenderTerraform(w, uniqueName, data, acl); err != nil {
	return fmt.Errorf("rendering blob %q: %w", p.Path(), err)
}

Defensive patterns

Strategy: try-catch

Validate before calling

if name == "" {
	return fmt.Errorf("blob resource name must be non-empty and unique")
}
if len(bytes) == 0 {
	log.Printf("warning: rendering empty blob %s", name)
}

Try / catch

if err := p.RenderTerraform(w, name, data, acl); err != nil {
	var wrapped error
	if strings.Contains(err.Error(), "rendering Azure Blob file:") {
		wrapped = errors.Unwrap(err)
		log.Printf("AddFilePath failed for blob %q: %v", p.Path(), wrapped)
	}
	return err
}

Prevention

Use unique, deterministic Terraform resource names per blob (container+key derived)
Keep the TerraformWriter single-use per output directory to avoid corrupted state
Test rendering with representative blob sizes before production cluster updates

When it happens

Trigger: Calling RenderTerraform on an *AzureBlobPath where the writer's AddFilePath call returns an error — e.g. the writer's file-store is closed/failed, duplicate resource names, or internal hashing/writing of the blob bytes fails.

Common situations: Rendering very large blobs that exceed writer limits; name collisions for the azurerm_storage_blob resource in the same Terraform output; using a TerraformWriter that previously hit an error and is in a bad state.

Related errors

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/7ea0c583a15c3a69. Report an issue: GitHub.

Appendix: source

Thrown at util/pkg/vfs/azureblob_terraform.go:51

func (p *AzureBlobPath) RenderTerraform(w *terraformWriter.TerraformWriter, name string, data io.Reader, acl ACL) error {
	bytes, err := io.ReadAll(data)
	if err != nil {
		return fmt.Errorf("reading data: %w", err)
	}

	w.EnsureTerraformProvider("azurerm", map[string]string{})

	if p.account == "" {
		return fmt.Errorf("Azure storage account is not set on path %q", p.Path())
	}
	if w.AzureStorageAccountID == "" {
		return fmt.Errorf("Azure storage account ID is not set; it is required to render blob %q", p.Path())
	}

	source, err := w.AddFilePath("azurerm_storage_blob", name, "source", bytes, false)
	if err != nil {
		return fmt.Errorf("rendering Azure Blob file: %w", err)
	}

	tf := &terraformAzureBlobFile{
		Name:               p.key,
		StorageContainerID: w.AzureStorageAccountID + "/blobServices/default/containers/" + p.container,
		Type:               "Block",
		Source:             source,
		Provider:           terraformWriter.LiteralTokens("azurerm", "files"),
	}
	return w.RenderResource("azurerm_storage_blob", name, tf)
}

View on GitHub (pinned to 4c8573c808)