kubernetes · kubernetes-prow · Jul 29, 2026 · Jul 29, 2026
diff --git a/tests/integration/update_cluster/gossip-azure/kubernetes.tf b/tests/integration/update_cluster/gossip-azure/kubernetes.tf
diff --git a/tests/integration/update_cluster/minimal_azure/kubernetes.tf b/tests/integration/update_cluster/minimal_azure/kubernetes.tf
diff --git a/upup/pkg/fi/cloudup/apply_cluster.go b/upup/pkg/fi/cloudup/apply_cluster.go
@@ -786,6 +786,7 @@ func (c *ApplyClusterCmd) Run(ctx context.Context) (*ApplyResults, error) {
 					args["subscription_id"] = storageAccountID.SubscriptionID
 				}
 			}
+			tf.AzureStorageAccountID = azureSpec.StorageAccountID
 			tf.EnsureTerraformProvider("azurerm", args)
 		}
 

diff --git a/upup/pkg/fi/cloudup/azuretasks/vmscaleset_terraform.go b/upup/pkg/fi/cloudup/azuretasks/vmscaleset_terraform.go
@@ -59,10 +59,10 @@ type terraformAzureVMScaleSetIPConfiguration struct {
 }
 
 type terraformAzureVMScaleSetNetworkInterface struct {
-	Name               *string                                    `cty:"name"`
-	Primary            *bool                                      `cty:"primary"`
-	EnableIPForwarding *bool                                      `cty:"enable_ip_forwarding"`
-	IPConfiguration    []*terraformAzureVMScaleSetIPConfiguration `cty:"ip_configuration"`
+	Name                *string                                    `cty:"name"`
+	Primary             *bool                                      `cty:"primary"`
+	IPForwardingEnabled *bool                                      `cty:"ip_forwarding_enabled"`
+	IPConfiguration     []*terraformAzureVMScaleSetIPConfiguration `cty:"ip_configuration"`
 }
 
 type terraformAzureVMScaleSetIdentity struct {
@@ -144,9 +144,9 @@ func (*VMScaleSet) RenderTerraform(t *terraform.TerraformTarget, a, e, changes *
 	}
 	tf.NetworkInterface = []*terraformAzureVMScaleSetNetworkInterface{
 		{
-			Name:               e.Name,
-			Primary:            new(true),
-			EnableIPForwarding: new(true),
+			Name:                e.Name,
+			Primary:             new(true),
+			IPForwardingEnabled: new(true),
 			IPConfiguration: []*terraformAzureVMScaleSetIPConfiguration{
 				ipConfig,
 			},

diff --git a/upup/pkg/fi/cloudup/terraform/target_hcl2.go b/upup/pkg/fi/cloudup/terraform/target_hcl2.go
@@ -283,7 +283,7 @@ func (t *TerraformTarget) writeTerraform(buf *bytes.Buffer) {
 			},
 			"azurerm": {
 				"source":  "hashicorp/azurerm",
-				"version": ">= 4.0.0",
+				"version": ">= 5.0.0",
 			},
 		}
 

diff --git a/upup/pkg/fi/cloudup/terraformWriter/writer.go b/upup/pkg/fi/cloudup/terraformWriter/writer.go
@@ -40,6 +40,12 @@ type TerraformWriter struct {
 	// Providers is a list of TF Providers we need for writing files
 	Providers map[string]*TerraformProvider
 
+	// AzureStorageAccountID is the Azure Resource Manager ID of the storage
+	// account holding the cluster's state blobs. It is needed to build the
+	// storage_container_id argument of azurerm_storage_blob resources, which
+	// the azurerm provider requires as of v5.0.
+	AzureStorageAccountID string
+
 	// Files is a map of TF resource Files that should be created
 	Files map[string][]byte
 }

diff --git a/util/pkg/vfs/azureblob_terraform.go b/util/pkg/vfs/azureblob_terraform.go
@@ -24,12 +24,11 @@ import (
 )
 
 type terraformAzureBlobFile struct {
-	Name                 string                   `cty:"name"`
-	StorageAccountName   string                   `cty:"storage_account_name"`
-	StorageContainerName string                   `cty:"storage_container_name"`
-	Type                 string                   `cty:"type"`
-	Source               *terraformWriter.Literal `cty:"source"`
-	Provider             *terraformWriter.Literal `cty:"provider"`
+	Name               string                   `cty:"name"`
+	StorageContainerID string                   `cty:"storage_container_id"`
+	Type               string                   `cty:"type"`
+	Source             *terraformWriter.Literal `cty:"source"`
+	Provider           *terraformWriter.Literal `cty:"provider"`
 }
 
 func (p *AzureBlobPath) RenderTerraform(w *terraformWriter.TerraformWriter, name string, data io.Reader, acl ACL) error {
@@ -43,19 +42,21 @@ func (p *AzureBlobPath) RenderTerraform(w *terraformWriter.TerraformWriter, name
 	if p.account == "" {
 		return fmt.Errorf("Azure storage account is not set on path %q", p.Path())
 	}
+	if w.AzureStorageAccountID == "" {
+		return fmt.Errorf("Azure storage account ID is not set; it is required to render blob %q", p.Path())
+	}
 
 	source, err := w.AddFilePath("azurerm_storage_blob", name, "source", bytes, false)
 	if err != nil {
 		return fmt.Errorf("rendering Azure Blob file: %w", err)
 	}
 
 	tf := &terraformAzureBlobFile{
-		Name:                 p.key,
-		StorageAccountName:   p.account,
-		StorageContainerName: p.container,
-		Type:                 "Block",
-		Source:               source,
-		Provider:             terraformWriter.LiteralTokens("azurerm", "files"),
+		Name:               p.key,
+		StorageContainerID: w.AzureStorageAccountID + "/blobServices/default/containers/" + p.container,
+		Type:               "Block",
+		Source:             source,
+		Provider:           terraformWriter.LiteralTokens("azurerm", "files"),
 	}
 	return w.RenderResource("azurerm_storage_blob", name, tf)
 }
diff --git a/util/pkg/vfs/memfs.go b/util/pkg/vfs/memfs.go
@@ -255,14 +255,14 @@ func (p *MemFSPath) renderTerraformAzure(w *terraformWriter.TerraformWriter, nam
 	}
 
 	// memfs:// paths don't encode an Azure account or container, so this
-	// fallback (only used in integration tests) hard-codes test placeholders.
+	// fallback (only used in integration tests) hard-codes a test placeholder
+	// container on the storage account from the cluster spec.
 	tf := &terraformAzureBlobFile{
-		Name:                 p.location,
-		StorageAccountName:   "teststorage",
-		StorageContainerName: "testcontainer",
-		Type:                 "Block",
-		Source:               source,
-		Provider:             terraformWriter.LiteralTokens("azurerm", "files"),
+		Name:               p.location,
+		StorageContainerID: w.AzureStorageAccountID + "/blobServices/default/containers/testcontainer",
+		Type:               "Block",
+		Source:             source,
+		Provider:           terraformWriter.LiteralTokens("azurerm", "files"),
 	}
 	return w.RenderResource("azurerm_storage_blob", name, tf)
 }
-Original file line number
+Diff line change
@@ Expand Up @@
     					args["subscription_id"] = storageAccountID.SubscriptionID
     				}
     			}
+    			tf.AzureStorageAccountID = azureSpec.StorageAccountID
     			tf.EnsureTerraformProvider("azurerm", args)
     		}
@@ Expand Down @@