{"record":{"id":"25a6f5a2910f5a3e","repo":"kubernetes/kops","slug":"creating-identity-w","errorCode":null,"errorMessage":"creating identity: %w","messagePattern":"creating identity: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/nodeidentity/azure/client.go","lineNumber":51,"sourceCode":"\tvmClient       *compute.VirtualMachinesClient\n\tvmssClient     *compute.VirtualMachineScaleSetVMsClient\n}\n\n// newClient returns a new Client.\nfunc newClient() (*client, error) {\n\t// nodeidentity.Identifier.New does not propagate a context; the IMDS HTTP client's own timeout\n\t// bounds this call.\n\tmetadata, err := azuremetadata.QueryComputeInstanceMetadata(context.TODO())\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"error querying instance metadata: %s\", err)\n\t}\n\tif metadata.SubscriptionID == \"\" {\n\t\treturn nil, fmt.Errorf(\"empty subscription ID\")\n\t}\n\n\tcred, err := azidentity.NewDefaultAzureCredential(nil)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"creating identity: %w\", err)\n\t}\n\n\tvmClient, err := compute.NewVirtualMachinesClient(metadata.SubscriptionID, cred, nil)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"creating VMs client: %w\", err)\n\t}\n\n\tvmssClient, err := compute.NewVirtualMachineScaleSetVMsClient(metadata.SubscriptionID, cred, nil)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"creating VMSS VMs client: %w\", err)\n\t}\n\n\treturn &client{\n\t\tvmClient:   vmClient,\n\t\tvmssClient: vmssClient,\n\t}, nil\n}\n","sourceCodeStart":33,"sourceCodeEnd":69,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/pkg/nodeidentity/azure/client.go#L33-L69","documentation":"newClient builds credentials via azidentity.NewDefaultAzureCredential, which chains environment, managed-identity, and CLI credential sources. If none of these sources can produce a usable token credential, the returned error is wrapped with this message and client creation fails.","triggerScenarios":"NewDefaultAzureCredential returns a non-nil error — no environment variables (AZURE_TENANT_ID/AZURE_CLIENT_ID/AZURE_CLIENT_SECRET or certificate vars), no accessible managed identity endpoint, and no az CLI login available.","commonSituations":"Running outside Azure with no service-principal env vars set; missing or mis-typed AZURE_* environment variables; managed identity disabled on the VM; az CLI logged out; a ChainedTokenCredential with zero usable credentials.","solutions":["Set Azure credential environment variables: AZURE_TENANT_ID, AZURE_CLIENT_ID, AZURE_CLIENT_SECRET (or AZURE_CLIENT_CERTIFICATE_PATH)","If running on an Azure VM/VMSS, ensure a managed identity is assigned to the instance","If using the CLI credential locally, run az login and set AZURE_TENANT_ID","Inspect the wrapped error to see which individual credentials in the chain failed and fix that source"],"exampleFix":"# before: no credential env vars -> 'creating identity' fails\n# after:\nexport AZURE_TENANT_ID=xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx\nexport AZURE_CLIENT_ID=xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx\nexport AZURE_CLIENT_SECRET=********  # or use managed identity on the VM","handlingStrategy":"validation","validationCode":"for _, v := range []string{\"AZURE_TENANT_ID\", \"AZURE_CLIENT_ID\", \"AZURE_CLIENT_SECRET\"} {\n    if os.Getenv(v) == \"\" && os.Getenv(\"USE_WORKLOAD_IDENTITY_AUTH\") == \"\" {\n        return fmt.Errorf(\"missing %s and no managed identity available\", v)\n    }\n}","typeGuard":null,"tryCatchPattern":"if err != nil {\n    return fmt.Errorf(\"azure credential chain failed: %w\", err)\n    // the inner error names which chained credential sources were tried\n}","preventionTips":["Set AZURE_TENANT_ID/AZURE_CLIENT_ID/AZURE_CLIENT_SECRET for non-Azure environments","Assign a managed identity to Azure nodes","Keep az CLI logged in for local development","Inspect the ChainedTokenCredential error to see which sources were attempted"],"tags":["azure","authentication","credentials","azidentity"],"backgroundTag":"azure-credential-chain-failed","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T12:17:11.808Z"}