{"record":{"id":"1da075834c172b64","repo":"kubernetes/kops","slug":"error-removing-audience-s-to-iamoidcprovider-v","errorCode":null,"errorMessage":"error removing audience %s to IAMOIDCProvider: %v","messagePattern":"error removing audience (.+?) to IAMOIDCProvider: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"upup/pkg/fi/cloudup/awstasks/iamoidcprovider.go","lineNumber":197,"sourceCode":"\t\t}\n\t\tif changes.ClientIDs != nil {\n\t\t\tactual := sets.NewString()\n\t\t\tfor _, aud := range a.ClientIDs {\n\t\t\t\tactual.Insert(aud)\n\t\t\t}\n\t\t\texpected := sets.NewString()\n\t\t\tfor _, aud := range e.ClientIDs {\n\t\t\t\texpected.Insert(aud)\n\t\t\t}\n\t\t\ttoRemove := actual.Difference(expected)\n\t\t\tfor _, elem := range toRemove.List() {\n\t\t\t\trequest := &iam.RemoveClientIDFromOpenIDConnectProviderInput{\n\t\t\t\t\tOpenIDConnectProviderArn: a.arn,\n\t\t\t\t\tClientID:                 &elem,\n\t\t\t\t}\n\t\t\t\t_, err := t.Cloud.IAM().RemoveClientIDFromOpenIDConnectProvider(ctx, request)\n\t\t\t\tif err != nil {\n\t\t\t\t\treturn fmt.Errorf(\"error removing audience %s to IAMOIDCProvider: %v\", elem, err)\n\t\t\t\t}\n\t\t\t}\n\t\t\ttoAdd := expected.Difference(actual)\n\t\t\tfor _, elem := range toAdd.List() {\n\t\t\t\trequest := &iam.AddClientIDToOpenIDConnectProviderInput{\n\t\t\t\t\tOpenIDConnectProviderArn: a.arn,\n\t\t\t\t\tClientID:                 &elem,\n\t\t\t\t}\n\t\t\t\t_, err := t.Cloud.IAM().AddClientIDToOpenIDConnectProvider(ctx, request)\n\t\t\t\tif err != nil {\n\t\t\t\t\treturn fmt.Errorf(\"error adding audience %s to IAMOIDCProvider: %v\", elem, err)\n\t\t\t\t}\n\t\t\t}\n\t\t}\n\t}\n\treturn nil\n}\n","sourceCodeStart":179,"sourceCodeEnd":215,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/upup/pkg/fi/cloudup/awstasks/iamoidcprovider.go#L179-L215","documentation":"Returned by IAMOIDCProvider.RenderAWS when RemoveClientIDFromOpenIDConnectProvider fails while pruning an audience (client ID) that is no longer desired on the OIDC provider. kOps diffs expected vs actual client IDs and removes the extras with this call. Note the message text says 'removing audience %s to' (a typo for 'from').","triggerScenarios":"RemoveClientIDFromOpenIDConnectProvider fails: missing iam:RemoveClientIDFromOpenIDConnectProvider permission, provider deleted concurrently, or the client ID was already removed by another actor (NoSuchEntity).","commonSituations":"Changing the cluster's service-account issuer audience configuration while another tool (e.g. eksctl) manages the same provider; IAM policies written before client-ID APIs were adopted; concurrent kops applies.","solutions":["Add iam:RemoveClientIDFromOpenIDConnectProvider and iam:AddClientIDToOpenIDConnectProvider to the kOps policy.","Re-run kops apply — if the audience was already removed, the next pass reconciles cleanly.","Check for other automation managing client IDs on the same provider ARN and single-source ownership.","Verify provider existence; recreate via apply if it was deleted."],"exampleFix":null,"handlingStrategy":"retry","validationCode":"// pre-read actual client IDs and only remove ones truly present\nout, err := iamClient.GetOpenIDConnectProviderWithContext(ctx, &iam.GetOpenIDConnectProviderInput{OpenIDConnectProviderArn: arn})\nif err != nil { return err }\npresent := sets.NewString(aws.StringValueSlice(out.ClientIDList)...)\ntoRemove := actual.Intersect(present) // skip already-removed audiences","typeGuard":"func isNoSuchEntity(err error) bool { var ae smithy.APIError; return errors.As(err, &ae) && ae.ErrorCode() == \"NoSuchEntityException\" }","tryCatchPattern":"_, err := iamClient.RemoveClientIDFromOpenIDConnectProviderWithContext(ctx, req)\nif err != nil {\n    if isNoSuchEntity(err) { continue } // already removed; reconcile next pass\n    return fmt.Errorf(\"error removing audience %s from IAMOIDCProvider: %w\", elem, err)\n}","preventionTips":["Grant iam:RemoveClientIDFromOpenIDConnectProvider and iam:AddClientIDToOpenIDConnectProvider","Treat NoSuchEntity as already-removed and continue rather than fail","Assign single ownership of provider client IDs to kOps","Re-run apply to reconcile after partial failures"],"tags":["aws","iam","oidc","kops","audience"],"backgroundTag":"iam-operation-unauthorized","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T07:17:12.445Z"}