{"record":{"id":"0748a3d6dd9440b4","repo":"kubernetes/kops","slug":"error-describing-oidc-provider-v","errorCode":null,"errorMessage":"error describing oidc provider: %v","messagePattern":"error describing oidc provider: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"upup/pkg/fi/cloudup/awstasks/iamoidcprovider.go","lineNumber":70,"sourceCode":"}\n\nfunc (e *IAMOIDCProvider) Find(c *fi.CloudupContext) (*IAMOIDCProvider, error) {\n\tctx := c.Context()\n\tcloud := awsup.GetCloud(c)\n\n\tresponse, err := cloud.IAM().ListOpenIDConnectProviders(ctx, &iam.ListOpenIDConnectProvidersInput{})\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"error listing oidc providers: %v\", err)\n\t}\n\n\tproviders := response.OpenIDConnectProviderList\n\tfor _, provider := range providers {\n\t\tarn := provider.Arn\n\t\tdescResp, err := cloud.IAM().GetOpenIDConnectProvider(ctx, &iam.GetOpenIDConnectProviderInput{\n\t\t\tOpenIDConnectProviderArn: arn,\n\t\t})\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"error describing oidc provider: %v\", err)\n\t\t}\n\t\t// AWS does not return the https:// in the url\n\t\tactualURL := aws.ToString(descResp.Url)\n\t\tif !strings.Contains(actualURL, \"://\") {\n\t\t\tactualURL = \"https://\" + actualURL\n\t\t}\n\n\t\tif actualURL == fi.ValueOf(e.URL) {\n\n\t\t\tactual := &IAMOIDCProvider{\n\t\t\t\tClientIDs:   descResp.ClientIDList,\n\t\t\t\tThumbprints: descResp.ThumbprintList,\n\t\t\t\tURL:         &actualURL,\n\t\t\t\tTags:        mapIAMTagsToMap(descResp.Tags),\n\t\t\t\tarn:         arn,\n\t\t\t}\n\n\t\t\tactual.Lifecycle = e.Lifecycle","sourceCodeStart":52,"sourceCodeEnd":88,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/upup/pkg/fi/cloudup/awstasks/iamoidcprovider.go#L52-L88","documentation":"Returned by IAMOIDCProvider.Find when GetOpenIDConnectProvider fails for one of the provider ARNs returned by ListOpenIDConnectProviders. This blocks kOps from comparing thumbprints/URL/audiences of an existing provider with the desired state.","triggerScenarios":"GetOpenIDConnectProvider fails on a listed ARN: missing iam:GetOpenIDConnectProvider permission, the provider was deleted between list and get (NoSuchEntity), or throttling when the account has many providers.","commonSituations":"Accounts with many OIDC providers (EKS clusters each create one) hitting throttling; a provider deleted concurrently by another tool; policies listing Get but not List (or vice versa).","solutions":["Add iam:GetOpenIDConnectProvider to the kOps IAM policy.","Re-run the command; if a specific ARN 404s, it was deleted concurrently and the next list will exclude it.","Check for other automation (e.g. EKS, eksctl) racing on the same account's OIDC providers.","Throttle/retry with backoff if the account holds many providers."],"exampleFix":null,"handlingStrategy":"retry","validationCode":"// ensure both list and get permissions exist before the discovery loop\nrequired := []string{\"iam:ListOpenIDConnectProviders\", \"iam:GetOpenIDConnectProvider\"}\n_ = required // validate via simulate-principal-policy","typeGuard":"func isNotFound(err error) bool { var ae smithy.APIError; return errors.As(err, &ae) && ae.ErrorCode() == \"NoSuchEntityException\" }","tryCatchPattern":"desc, err := iamClient.GetOpenIDConnectProviderWithContext(ctx, &iam.GetOpenIDConnectProviderInput{OpenIDConnectProviderArn: arn})\nif err != nil {\n    if isNotFound(err) { continue } // provider vanished between list and get\n    return nil, fmt.Errorf(\"error describing oidc provider: %w\", err)\n}","preventionTips":["Skip-and-continue on NoSuchEntity during enumeration races","Back off on throttling when the account has many providers","Prevent other tooling from deleting OIDC providers concurrently","Grant both List and Get OIDC provider permissions"],"tags":["aws","iam","oidc","kops"],"backgroundTag":"iam-operation-unauthorized","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T07:17:12.445Z"}