weaviate/weaviate · critical

init Azure export client

Error message

init Azure export client

What it means

Weaviate's backup-azure module wraps any failure from constructing the export-only Azure Blob client during module Init with the message "init Azure export client". The export client intentionally has no default container or path; it is configured lazily per export via EXPORT_DEFAULT_BUCKET and EXPORT_DEFAULT_PATH. newClient fails when Azure credentials are absent or malformed: AZURE_STORAGE_CONNECTION_STRING cannot be parsed, AZURE_STORAGE_ACCOUNT is unset, or AZURE_STORAGE_KEY cannot build a SharedKeyCredential. Because Init runs at server startup, this error aborts loading the module entirely.

Source

Thrown at modules/backup-azure/module.go:106

	}
	if config.Container == "" {
		return errors.Errorf("backup init: '%s' must be set", azureContainer)
	}

	client, err := newClient(ctx, config, m.dataPath, m.logger)
	if err != nil {
		return errors.Wrap(err, "init Azure client")
	}
	m.azureClient = client

	exportConfig := &clientConfig{
		Container:       "", // export scheduler provides bucket via EXPORT_DEFAULT_BUCKET
		BackupPath:      "", // export scheduler provides path via EXPORT_DEFAULT_PATH
		SkipAccessCheck: params.GetConfig().Export.SkipAccessCheck,
	}
	exportClient, err := newClient(ctx, exportConfig, m.dataPath, m.logger)
	if err != nil {
		return errors.Wrap(err, "init Azure export client")
	}
	m.exportClient = exportClient
	return nil
}

func (m *Module) MetaInfo() (map[string]interface{}, error) {
	metaInfo := make(map[string]interface{})
	metaInfo["containerName"] = m.config.Container
	if root := m.config.BackupPath; root != "" {
		metaInfo["rootName"] = root
	}
	return metaInfo, nil
}

// ExportBackend returns the export-specific backend. It has no default
// container or path; the export scheduler supplies both via
// EXPORT_DEFAULT_BUCKET and EXPORT_DEFAULT_PATH.
func (m *Module) ExportBackend() modulecapabilities.BackupBackend {

View on GitHub (pinned to 75aa4b6d11)

Solutions

1. Set AZURE_STORAGE_CONNECTION_STRING to a valid Azure Blob connection string, or set both AZURE_STORAGE_ACCOUNT and AZURE_STORAGE_KEY.
2. Read the wrapped inner error in server logs — it states which step failed ("create client using connection string", "AZURE_STORAGE_ACCOUNT must be set", credential construction).
3. If using connection-string auth, verify it contains AccountName, AccountKey (or SAS), and BlobEndpoint segments, unquoted and semicolon-separated.
4. If relying on default-credential (no key), ensure the environment has valid Azure AD identity (managed identity on AKS, az login locally).
5. As a diagnostic only, set BACKUP_SKIP_ACCESS_CHECK / export skip-access-check — this does not fix credential construction; credentials are always required.

Example fix

// before: module enabled but no Azure credentials in the environment
AZURE_STORAGE_ACCOUNT=""
AZURE_STORAGE_KEY=""

// after: provide valid credentials (connection-string form)
AZURE_STORAGE_CONNECTION_STRING="DefaultEndpointsProtocol=https;AccountName=mystorageacct;AccountKey=<base64-key>;BlobEndpoint=https://mystorageacct.blob.core.windows.net/"

// Run before enabling backup-azure (e.g. in entrypoint/healthcheck):
if [ -z "$AZURE_STORAGE_CONNECTION_STRING" ]; then
  if [ -z "$AZURE_STORAGE_ACCOUNT" ]; then
    echo "backup-azure requires AZURE_STORAGE_CONNECTION_STRING or AZURE_STORAGE_ACCOUNT" >&2
    exit 1
  fi
fi

err := module.Init(ctx, params)
var initErr *modstgazure.InitError
if errors.As(err, &initErr) {
    logger.Fatalf("backup-azure init failed: %v — check AZURE_STORAGE_* env vars", initErr)
}

When it happens

Trigger: Server startup with backup-azure enabled when: (1) AZURE_STORAGE_CONNECTION_STRING is set but invalid (e.g. malformed key, missing AccountName segment) so azblob.NewClientFromConnectionString fails; (2) neither AZURE_STORAGE_CONNECTION_STRING nor AZURE_STORAGE_ACCOUNT is set; (3) AZURE_STORAGE_ACCOUNT is set but AZURE_STORAGE_KEY is empty/invalid, or DefaultAzureCredential (used when no key) cannot be constructed. Note the backup client (line 93) is initialized first, so the same root cause usually surfaces earlier as "init Azure client" — seeing the export variant means the primary env path succeeded differently or SkipAccessCheck masking differs.

Common situations: Kubernetes deployments where the secret mounting AZURE_STORAGE_CONNECTION_STRING is missing or has a typo'd key; switching from connection-string auth to account-name-only auth after a credentials rotation; running locally without any Azure env vars but with backup-azure in ENABLE_MODULES; malformed connection strings copied with quotes or extra whitespace.

Related errors

• backup init: '%s' must be set
• init Azure client
• can't create the default handler, as no api is set
• required variable GPT4ALL_INFERENCE_API is not set
• NAMESPACES_ENABLED=true but cluster has %d non-namespaced co

AI-assisted analysis of weaviate/weaviate@75aa4b6d11 (2026-09-04). Data as JSON: /api/errors/109603e7f12b5338. Report an issue: GitHub.