{"record":{"id":"7300e3d11291bc3d","repo":"kubernetes/kops","slug":"error-creating-iamoidcprovider-v","errorCode":null,"errorMessage":"error creating IAMOIDCProvider: %v","messagePattern":"error creating IAMOIDCProvider: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"upup/pkg/fi/cloudup/awstasks/iamoidcprovider.go","lineNumber":137,"sourceCode":"}\n\nfunc (p *IAMOIDCProvider) RenderAWS(t *awsup.AWSAPITarget, a, e, changes *IAMOIDCProvider) error {\n\tctx := context.TODO()\n\tthumbprints := e.Thumbprints\n\n\tif a == nil {\n\t\tklog.V(2).Infof(\"Creating IAMOIDCProvider with Name:%q\", *e.Name)\n\n\t\trequest := &iam.CreateOpenIDConnectProviderInput{\n\t\t\tClientIDList:   e.ClientIDs,\n\t\t\tThumbprintList: thumbprints,\n\t\t\tUrl:            e.URL,\n\t\t\tTags:           mapToIAMTags(e.Tags),\n\t\t}\n\n\t\tresponse, err := t.Cloud.IAM().CreateOpenIDConnectProvider(ctx, request)\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"error creating IAMOIDCProvider: %v\", err)\n\t\t}\n\n\t\te.arn = response.OpenIDConnectProviderArn\n\t} else {\n\t\tif changes.Thumbprints != nil {\n\t\t\tklog.V(2).Infof(\"Updating IAMOIDCProvider Thumbprints %q\", fi.ValueOf(e.arn))\n\n\t\t\trequest := &iam.UpdateOpenIDConnectProviderThumbprintInput{}\n\t\t\trequest.OpenIDConnectProviderArn = a.arn\n\t\t\trequest.ThumbprintList = thumbprints\n\n\t\t\t_, err := t.Cloud.IAM().UpdateOpenIDConnectProviderThumbprint(ctx, request)\n\t\t\tif err != nil {\n\t\t\t\treturn fmt.Errorf(\"error updating IAMOIDCProvider Thumbprints: %v\", err)\n\t\t\t}\n\t\t}\n\t\tif changes.Tags != nil {\n\t\t\tif len(a.Tags) > 0 {","sourceCodeStart":119,"sourceCodeEnd":155,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/upup/pkg/fi/cloudup/awstasks/iamoidcprovider.go#L119-L155","documentation":"Returned by IAMOIDCProvider.RenderAWS when CreateOpenIDConnectProvider fails while kOps creates the OIDC provider for the cluster's service-account issuer. When no matching provider is found during Find, kOps creates one; this wrapper captures any failure of that creation call.","triggerScenarios":"CreateOpenIDConnectProvider fails: provider already exists for the same URL (DuplicateOpenIDConnectProvider / EntityAlreadyExists), missing iam:CreateOpenIDConnectProvider permission, invalid URL, or fewer than one thumbprint supplied.","commonSituations":"Two clusters sharing the same public OIDC endpoint where one was created manually or by another cluster; SCPs denying OIDC provider creation; cluster spec issuer URL typo (not https, wrong host).","solutions":["Check if an OIDC provider for the same issuer URL already exists; if the account limits providers, reuse/reference it instead of creating a new one.","Grant iam:CreateOpenIDConnectProvider to the kOps principal.","Verify the issuer URL in the cluster spec is a valid https URL and thumbprints are populated.","Ensure no concurrent kops apply is creating the same provider."],"exampleFix":"// before: duplicated issuer across clusters without reuse\nURL: fi.String(\"https://shared.example.com\") // provider already exists -> error\n// after: point both clusters at the existing provider or unique issuers\nURL: fi.String(\"https://discovery-8c1d.example.com\")","handlingStrategy":"validation","validationCode":"// pre-check: does a provider for this issuer URL already exist?\nlist, _ := iamClient.ListOpenIDConnectProvidersWithContext(ctx, &iam.ListOpenIDConnectProvidersInput{})\nfor _, p := range list.OpenIDConnectProviderList {\n    d, _ := iamClient.GetOpenIDConnectProviderWithContext(ctx, &iam.GetOpenIDConnectProviderInput{OpenIDConnectProviderArn: p.Arn})\n    if strings.Contains(aws.ToString(d.Url), issuerHost) { return fmt.Errorf(\"provider for %s already exists: %s\", issuerHost, aws.ToString(p.Arn)) }\n}","typeGuard":"func isDuplicateProvider(err error) bool { var ae smithy.APIError; return errors.As(err, &ae) && (ae.ErrorCode() == \"EntityAlreadyExistsException\" || ae.ErrorCode() == \"InvalidRequestException\") }","tryCatchPattern":null,"preventionTips":["Use a unique discovery host per cluster so issuer URLs don't collide","Validate the issuer URL is https and publicly reachable before apply","Grant iam:CreateOpenIDConnectProvider in the kOps policy","Run one reconciler at a time against the same AWS account"],"tags":["aws","iam","oidc","kops"],"backgroundTag":"iam-operation-unauthorized","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T07:17:12.445Z"}