{"record":{"id":"106c14fe13338a95","repo":"kubernetes/kops","slug":"error-adding-audience-s-to-iamoidcprovider-v","errorCode":null,"errorMessage":"error adding audience %s to IAMOIDCProvider: %v","messagePattern":"error adding audience (.+?) to IAMOIDCProvider: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"upup/pkg/fi/cloudup/awstasks/iamoidcprovider.go","lineNumber":208,"sourceCode":"\t\t\tfor _, elem := range toRemove.List() {\n\t\t\t\trequest := &iam.RemoveClientIDFromOpenIDConnectProviderInput{\n\t\t\t\t\tOpenIDConnectProviderArn: a.arn,\n\t\t\t\t\tClientID:                 &elem,\n\t\t\t\t}\n\t\t\t\t_, err := t.Cloud.IAM().RemoveClientIDFromOpenIDConnectProvider(ctx, request)\n\t\t\t\tif err != nil {\n\t\t\t\t\treturn fmt.Errorf(\"error removing audience %s to IAMOIDCProvider: %v\", elem, err)\n\t\t\t\t}\n\t\t\t}\n\t\t\ttoAdd := expected.Difference(actual)\n\t\t\tfor _, elem := range toAdd.List() {\n\t\t\t\trequest := &iam.AddClientIDToOpenIDConnectProviderInput{\n\t\t\t\t\tOpenIDConnectProviderArn: a.arn,\n\t\t\t\t\tClientID:                 &elem,\n\t\t\t\t}\n\t\t\t\t_, err := t.Cloud.IAM().AddClientIDToOpenIDConnectProvider(ctx, request)\n\t\t\t\tif err != nil {\n\t\t\t\t\treturn fmt.Errorf(\"error adding audience %s to IAMOIDCProvider: %v\", elem, err)\n\t\t\t\t}\n\t\t\t}\n\t\t}\n\t}\n\treturn nil\n}\n\ntype terraformIAMOIDCProvider struct {\n\tURL            *string  `cty:\"url\"`\n\tClientIDList   []string `cty:\"client_id_list\"`\n\tThumbprintList []string `cty:\"thumbprint_list\"`\n\n\tAssumeRolePolicy *terraformWriter.Literal `cty:\"assume_role_policy\"`\n\tTags             map[string]string        `cty:\"tags\"`\n}\n\nfunc (p *IAMOIDCProvider) RenderTerraform(t *terraform.TerraformTarget, a, e, changes *IAMOIDCProvider) error {\n\terr := t.AddOutputVariable(\"iam_openid_connect_provider_arn\", e.TerraformLink())","sourceCodeStart":190,"sourceCodeEnd":226,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/upup/pkg/fi/cloudup/awstasks/iamoidcprovider.go#L190-L226","documentation":"During RenderAWS, kOps ensures every configured OIDC audience (client ID) is present on the IAM OIDC identity provider by calling AddClientIDToOpenIDConnectProvider. If that AWS API call returns an error, it is wrapped with the failing audience value so the operator knows which client ID could not be added.","triggerScenarios":"AddClientIDToOpenIDConnectProvider fails: OIDC provider ARN does not exist, was deleted out-of-band, audience already exceeds provider limits, throttling, or IAM permission denied for the caller.","commonSituations":"Cluster created with a provider whose ARN was changed in state; IAM policy of the kOps controller lacks iam:AddClientIDToOpenIDConnectProvider; provider deleted in AWS console while cluster spec still references it; concurrent reconcile racing.","solutions":["Verify the OIDC provider ARN still exists in AWS (aws iam get-open-id-connect-provider) and recreate it if deleted","Grant the calling principal iam:AddClientIDToOpenIDConnectProvider on the provider ARN","Re-run kOps update/reconcile after fixing permissions; transient throttling errors are retried by re-running","Check the audience value matches the cluster's service-account issuer configuration"],"exampleFix":"// before: controller policy without OIDC write access\n// after\n{\"Effect\":\"Allow\",\"Action\":[\"iam:AddClientIDToOpenIDConnectProvider\",\"iam:RemoveClientIDFromOpenIDConnectProvider\"],\"Resource\":\"arn:aws:iam::<account>:oidc-provider/<provider>\"}","handlingStrategy":"try-catch","validationCode":"// pre-check the OIDC provider exists and audiences\nimport \"github.com/aws/aws-sdk-go-v2/service/iam\"\nout, err := iamClient.GetOpenIDConnectProvider(ctx, &iam.GetOpenIDConnectProviderInput{OpenIDConnectProviderArn: arn})\nif err != nil { /* provider missing or inaccessible; fix before adding audience */ }","typeGuard":null,"tryCatchPattern":"_, err := t.Cloud.IAM().AddClientIDToOpenIDConnectProvider(ctx, request)\nvar nfe *types.NoSuchEntityException\nswitch {\ncase errors.As(err, &nfe):\n    klog.Warningf(\"OIDC provider %s gone; recreate provider then re-run\", a.arn)\ncase err != nil:\n    return fmt.Errorf(\"error adding audience %s to IAMOIDCProvider: %w\", elem, err)\n}","preventionTips":["Verify the OIDC provider ARN exists before running cluster update","Least-privilege but complete IAM policy for the kOps controller (Add/RemoveClientID)","Avoid manual deletion of the OIDC provider while the cluster is active","Deduplicate audiences in the cluster spec to avoid limit churn"],"tags":["aws","iam","oidc","reconcile"],"backgroundTag":"aws-iam-api-error","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T07:17:12.445Z"}