{"record":{"id":"04025b8690dec010","repo":"kubernetes/kops","slug":"error-building-openstack-provider-client-v-04025b","errorCode":null,"errorMessage":"error building openstack provider client: %v","messagePattern":"error building openstack provider client: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"util/pkg/vfs/swiftfs.go","lineNumber":58,"sourceCode":"\t\"k8s.io/apimachinery/pkg/util/wait\"\n\t\"k8s.io/client-go/util/homedir\"\n\t\"k8s.io/klog/v2\"\n\t\"k8s.io/kops/util/pkg/hashing\"\n\t\"k8s.io/kops/util/pkg/vfs/openstackconfig\"\n)\n\nfunc NewSwiftClient(ctx context.Context) (*gophercloud.ServiceClient, error) {\n\tconfig := OpenstackConfig{}\n\n\t// Check if env credentials are valid first\n\tauthOption, err := config.GetCredential()\n\tif err != nil {\n\t\treturn nil, err\n\t}\n\n\tpc, err := openstack.NewClient(authOption.IdentityEndpoint)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"error building openstack provider client: %v\", err)\n\t}\n\tua := gophercloud.UserAgent{}\n\tua.Prepend(\"kops/swift\")\n\tpc.UserAgent = ua\n\tklog.V(4).Infof(\"Using user-agent %s\", ua.Join())\n\n\ttlsconfig := &tls.Config{}\n\ttlsconfig.InsecureSkipVerify = config.GetInsecureSkipVerify()\n\ttransport := &http.Transport{TLSClientConfig: tlsconfig}\n\tpc.HTTPClient = http.Client{\n\t\tTransport: transport,\n\t}\n\n\tklog.V(2).Info(\"authenticating to keystone\")\n\n\terr = openstack.Authenticate(ctx, pc, authOption)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"error building openstack authenticated client: %v\", err)","sourceCodeStart":40,"sourceCodeEnd":76,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/util/pkg/vfs/swiftfs.go#L40-L76","documentation":"NewSwiftClient builds a gophercloud provider client for OpenStack. openstack.NewClient parses the identity endpoint and constructs the HTTP client; a malformed or unreachable-to-parse identity endpoint URL causes this error. It wraps the gophercloud error with %v.","triggerScenarios":"getSwiftClient -> NewSwiftClient when authOption.IdentityEndpoint (from OS_* env vars or the openstack config file) is empty, malformed, or not a valid URL.","commonSituations":"OS_AUTH_URL unset or misspelled (e.g. missing https://), wrong keystone port, or a config file whose 'identity' key contains an invalid URL.","solutions":["Set OS_AUTH_URL to a valid keystone endpoint, e.g. export OS_AUTH_URL=https://keystone.example.com:5000/v3.","Check the 'identity' value in ~/.openstack/config (or OPENSTACK_CREDENTIAL_FILE) is a full valid URL.","Verify with curl that the identity endpoint is reachable: curl <auth-url>.","Read the wrapped %v cause for the exact URL parse failure."],"exampleFix":"// before (config)\nidentity = keystone.example.com:5000/v3\n// after\nidentity = https://keystone.example.com:5000/v3","handlingStrategy":"validation","validationCode":"// Validate the identity endpoint before calling NewSwiftClient\nauthURL := os.Getenv(\"OS_AUTH_URL\")\nif u, err := url.Parse(authURL); err != nil || u.Scheme == \"\" || u.Host == \"\" {\n\treturn fmt.Errorf(\"OS_AUTH_URL %q is not a valid URL\", authURL)\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Always export OS_AUTH_URL with scheme and port (https://host:5000/v3)","Source the same rc file your openstack CLI uses","curl the endpoint once to confirm reachability","Keep identity in the config file a full absolute URL"],"tags":["openstack","swift","gophercloud","config"],"backgroundTag":"invalid-endpoint-url","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T07:17:12.445Z"}