wtfutil/wtf · error

azure credentials not initialized for subscription %s: pleas

Error message

azure credentials not initialized for subscription %s: please set up authentication first

What it means

CreateLogsClient builds a cached Azure Log Analytics (azquery.LogsClient) for a subscription. Before constructing the client it checks that the Azure credential chain on the Session has been initialized; if sess.Azure.Credential is nil it refuses to proceed with this error instead of panicking inside the SDK. It means authentication setup (Init/credential load) was skipped or failed earlier.

Source

Thrown at modules/azurelogs/session.go:94

			&azidentity.ClientSecretCredentialOptions{})
		if err != nil {
			return err
		}
		return nil
	}

	sess.Azure.Credential, err = azidentity.NewDefaultAzureCredential(&azidentity.DefaultAzureCredentialOptions{})
	if err != nil {
		return err
	}

	return nil
}

// CreateLogsClient creates a cached Azure Log Analytics client for the specified subscription
func CreateLogsClient(sess *Session, subscriptionID string) (*azquery.LogsClient, error) {
	if sess.Azure.Credential == nil {
		return nil, fmt.Errorf("azure credentials not initialized for subscription %s: please set up authentication first", subscriptionID)
	}

	// Create a new client for this subscription ID using modern Azure SDK
	client, err := azquery.NewLogsClient(sess.Azure.Credential, nil)
	if err != nil {
		return nil, fmt.Errorf("failed to create Azure Logs client for subscription %s: %w", subscriptionID, err)
	}

	return client, nil
}

View on GitHub (pinned to bb838c1ccb)

Solutions

1. Call Init() (or the equivalent credential setup) before CreateLogsClient and check its error
2. Run `az login` locally or configure Azure service-principal env vars in CI
3. Inspect the Session to ensure sess.Azure.Credential is non-nil before querying

Example fix

// before
sess := &azurelogs.Session{}
client, err := azurelogs.CreateLogsClient(sess, subID) // error: credentials not initialized
// after
sess, err := azurelogs.Init(&queryfile)
if err != nil {
    return err
}
client, err := azurelogs.CreateLogsClient(sess, subID)

if sess == nil || sess.Azure == nil || sess.Azure.Credential == nil {
    return errors.New("azure credentials not initialized: call Init() first")
}
client, err := CreateLogsClient(sess, subscriptionID)

func hasAzureCred(sess *Session) bool {
    return sess != nil && sess.Azure != nil && sess.Azure.Credential != nil
}

When it happens

Trigger: Calling CreateLogsClient (directly or via RunQuery) on a Session whose Azure.Credential is nil — e.g. Init() was never called, failed silently, or a Session struct was constructed manually without running the authentication setup.

Common situations: Missing AZURE_CLIENT_ID/AZURE_TENANT_ID/AZURE_CLIENT_SECRET or az login in CI; widget code instantiating its own Session instead of calling Init; tests creating a bare &Session{}; credentials nil because an earlier Init error was ignored.

Understand the failure class

• Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

Related errors

• failed to create Azure Logs client for subscription %s: %w
• failed to initialize Azure authentication: %w
• failed to create Azure Logs client for subscription %s: %w
• failed to initialize Azure session: %w
• failed to execute Azure query: %w

AI-assisted analysis of wtfutil/wtf@bb838c1ccb (2026-09-03). Data as JSON: /api/errors/dec10bdbdc55ce41. Report an issue: GitHub.