{"record":{"id":"7ce9ced8b9dad044","repo":"kubernetes/kops","slug":"error-listing-oidc-providers-v","errorCode":null,"errorMessage":"error listing oidc providers: %v","messagePattern":"error listing oidc providers: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"upup/pkg/fi/cloudup/awstasks/iamoidcprovider.go","lineNumber":60,"sourceCode":"\tName *string\n\tTags map[string]string\n\n\tarn *string\n}\n\nvar _ fi.CompareWithID = (*IAMOIDCProvider)(nil)\n\nfunc (e *IAMOIDCProvider) CompareWithID() *string {\n\treturn e.Name\n}\n\nfunc (e *IAMOIDCProvider) Find(c *fi.CloudupContext) (*IAMOIDCProvider, error) {\n\tctx := c.Context()\n\tcloud := awsup.GetCloud(c)\n\n\tresponse, err := cloud.IAM().ListOpenIDConnectProviders(ctx, &iam.ListOpenIDConnectProvidersInput{})\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"error listing oidc providers: %v\", err)\n\t}\n\n\tproviders := response.OpenIDConnectProviderList\n\tfor _, provider := range providers {\n\t\tarn := provider.Arn\n\t\tdescResp, err := cloud.IAM().GetOpenIDConnectProvider(ctx, &iam.GetOpenIDConnectProviderInput{\n\t\t\tOpenIDConnectProviderArn: arn,\n\t\t})\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"error describing oidc provider: %v\", err)\n\t\t}\n\t\t// AWS does not return the https:// in the url\n\t\tactualURL := aws.ToString(descResp.Url)\n\t\tif !strings.Contains(actualURL, \"://\") {\n\t\t\tactualURL = \"https://\" + actualURL\n\t\t}\n\n\t\tif actualURL == fi.ValueOf(e.URL) {","sourceCodeStart":42,"sourceCodeEnd":78,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/upup/pkg/fi/cloudup/awstasks/iamoidcprovider.go#L42-L78","documentation":"Returned by IAMOIDCProvider.Find when ListOpenIDConnectProviders fails, preventing kOps from discovering existing OIDC providers to match against the cluster's service-account issuer. kOps wraps the raw AWS error because any failure here blocks the Find pass entirely.","triggerScenarios":"cloud.IAM().ListOpenIDConnectProviders fails during the Find pass: missing iam:ListOpenIDConnectProviders permission, throttling, or connectivity errors.","commonSituations":"Least-privilege IAM policies for kOps missing ListOpenIDConnectProviders; corporate proxy/firewall blocking STS/IAM endpoints; region misconfiguration in the kops cluster spec.","solutions":["Add iam:ListOpenIDConnectProviders to the kOps principal's IAM policy.","Check region/endpoint configuration in the cluster spec and AWS credentials.","Retry the command — throttling is a common transient cause.","If using an IAM role/chained credentials, verify the role session has the permission after AssumeRole."],"exampleFix":null,"handlingStrategy":"retry","validationCode":"// verify credentials and region before listing\n_, err := stsClient.GetCallerIdentityWithContext(ctx, &sts.GetCallerIdentityInput{})\n// also ensure the session region matches the cluster region","typeGuard":"func isAccessDenied(err error) bool { var ae smithy.APIError; return errors.As(err, &ae) && ae.ErrorCode() == \"AccessDeniedException\" }","tryCatchPattern":"resp, err := iamClient.ListOpenIDConnectProvidersWithContext(ctx, &iam.ListOpenIDConnectProvidersInput{})\nif err != nil {\n    if isThrottling(err) { return retryWithBackoff(ctx, op) }\n    return fmt.Errorf(\"error listing oidc providers: %w\", err)\n}","preventionTips":["Include iam:ListOpenIDConnectProviders in the kOps policy template","Set the correct AWS_REGION for the cluster","Apply exponential backoff on ThrottlingException","Test credentials with aws sts get-caller-identity first"],"tags":["aws","iam","oidc","kops"],"backgroundTag":"iam-operation-unauthorized","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T07:17:12.445Z"}