{"record":{"id":"62b806a80aed3964","repo":"kubernetes/kops","slug":"creating-an-identity-w","errorCode":null,"errorMessage":"creating an identity: %w","messagePattern":"creating an identity: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"upup/pkg/fi/cloudup/azure/verifier.go","lineNumber":308,"sourceCode":"\n// newVerifierClient builds Azure API clients scoped to the local instance's subscription and\n// resource group from IMDS metadata.\nfunc newVerifierClient(ctx context.Context) (*client, error) {\n\tmetadata, err := azuremetadata.QueryComputeInstanceMetadata(ctx)\n\tif err != nil || metadata == nil {\n\t\treturn nil, fmt.Errorf(\"getting instance metadata: %w\", err)\n\t}\n\tif metadata.ResourceGroupName == \"\" {\n\t\treturn nil, fmt.Errorf(\"empty resource group name\")\n\t}\n\tif metadata.SubscriptionID == \"\" {\n\t\treturn nil, fmt.Errorf(\"empty subscription ID\")\n\t}\n\tklog.V(4).Infof(\"Azure verifier client using subscription %q resource group %q\", metadata.SubscriptionID, metadata.ResourceGroupName)\n\n\tcred, err := azidentity.NewDefaultAzureCredential(nil)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"creating an identity: %w\", err)\n\t}\n\n\tnisClient, err := network.NewInterfacesClient(metadata.SubscriptionID, cred, nil)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"creating interfaces client: %w\", err)\n\t}\n\tvmsClient, err := compute.NewVirtualMachinesClient(metadata.SubscriptionID, cred, nil)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"creating VMs client: %w\", err)\n\t}\n\tvmssVMsClient, err := compute.NewVirtualMachineScaleSetVMsClient(metadata.SubscriptionID, cred, nil)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"creating VMSSVMs client: %w\", err)\n\t}\n\n\treturn &client{\n\t\tsubscriptionID: metadata.SubscriptionID,\n\t\tresourceGroup:  metadata.ResourceGroupName,","sourceCodeStart":290,"sourceCodeEnd":326,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/upup/pkg/fi/cloudup/azure/verifier.go#L290-L326","documentation":"azidentity.NewDefaultAzureCredential could not construct a credential chain (managed identity, environment, CLI, etc.). The verifier wraps the underlying azidentity error, meaning it found no usable token source for calling the Azure management APIs.","triggerScenarios":"DefaultAzureCredential iterates its chain on first GetToken; NewDefaultAzureCredential itself errors only for invalid options/environment (e.g. malformed AZURE_CLIENT_CERTIFICATE_PATH, bad AZURE_TENANT_ID/AZURE_CLIENT_ID combo), while actual auth failures surface later — but wrapped causes here typically indicate no managed identity assigned to the VM.","commonSituations":"VM has no system/user-assigned managed identity with rights on the cluster resource group; kOps-created VMs expected to use managed identity but identity not yet assigned; CI running locally without az login; conflicting AZURE_* environment variables (e.g. AZURE_CLIENT_ID without AZURE_CLIENT_SECRET path).","solutions":["Assign a managed identity to the VM and grant it Reader/Contributor on the cluster resource group: az vm identity assign -g rg -n node1","Check for stray AZURE_* env vars that break the credential chain (AZURE_CLIENT_ID set without matching secret/cert)","On a dev machine run `az login` so the CLI credential in the chain works","Review the wrapped azidentity message for which chained credential failed"],"exampleFix":"// before: no identity\n$ az vm show -g rg -n node1 --query identity  # null\n// after\n$ az vm identity assign -g rg -n node1\n$ az role assignment create --assignee <principal-id> --role Contributor --scope /subscriptions/<sub>/resourceGroups/<rg>","handlingStrategy":"try-catch","validationCode":"// Pre-flight: ensure a managed identity exists on this VM\nident, err := azidentity.NewManagedIdentityCredential(nil)\nif err != nil { log.Fatal(\"no usable Azure credential on this VM: \", err) }\n// and no conflicting env vars\nfor _, k := range []string{\"AZURE_CLIENT_ID\",\"AZURE_TENANT_ID\",\"AZURE_CLIENT_SECRET\"} {\n\tif os.Getenv(k) != \"\" { log.Printf(\"warning: %s set; DefaultAzureCredential chain altered\", k) }\n}","typeGuard":null,"tryCatchPattern":"_, err := newVerifierClient(ctx)\nvar respErr *azidentity.AuthenticationFailedError\nif err != nil {\n\tif errors.As(err, &respErr) {\n\t\t// credential chain failed: check managed identity assignment & RBAC, then retry after fixing\n\t}\n\treturn err\n}","preventionTips":["Always assign a managed identity to kops Azure nodes with RBAC on the cluster resource group","Avoid scattering AZURE_* env vars on nodes","Run `az login` on dev machines before local verification","Grant the identity Reader/Contributor on the resource group at cluster creation"],"tags":["azure","auth","identity","azidentity"],"backgroundTag":"no-azure-credential","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T07:17:12.445Z"}