{"record":{"id":"9335faeed3f1c4db","repo":"kubernetes/kops","slug":"creating-vms-client-w","errorCode":null,"errorMessage":"creating VMs client: %w","messagePattern":"creating VMs client: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/nodeidentity/azure/client.go","lineNumber":56,"sourceCode":"func newClient() (*client, error) {\n\t// nodeidentity.Identifier.New does not propagate a context; the IMDS HTTP client's own timeout\n\t// bounds this call.\n\tmetadata, err := azuremetadata.QueryComputeInstanceMetadata(context.TODO())\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"error querying instance metadata: %s\", err)\n\t}\n\tif metadata.SubscriptionID == \"\" {\n\t\treturn nil, fmt.Errorf(\"empty subscription ID\")\n\t}\n\n\tcred, err := azidentity.NewDefaultAzureCredential(nil)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"creating identity: %w\", err)\n\t}\n\n\tvmClient, err := compute.NewVirtualMachinesClient(metadata.SubscriptionID, cred, nil)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"creating VMs client: %w\", err)\n\t}\n\n\tvmssClient, err := compute.NewVirtualMachineScaleSetVMsClient(metadata.SubscriptionID, cred, nil)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"creating VMSS VMs client: %w\", err)\n\t}\n\n\treturn &client{\n\t\tvmClient:   vmClient,\n\t\tvmssClient: vmssClient,\n\t}, nil\n}\n\nfunc (c *client) getVMTags(ctx context.Context, providerID string) (map[string]*string, error) {\n\tif !strings.HasPrefix(providerID, \"azure://\") {\n\t\treturn nil, fmt.Errorf(\"unknown providerID : %s\", providerID)\n\t}\n","sourceCodeStart":38,"sourceCodeEnd":74,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/pkg/nodeidentity/azure/client.go#L38-L74","documentation":"After credentials are obtained, newClient constructs the armcompute VirtualMachinesClient for the node's subscription. If SDK client construction fails, the underlying error is wrapped with 'creating VMs client'. This is typically an invalid subscription ID format rather than a network issue, since construction is local.","triggerScenarios":"compute.NewVirtualMachinesClient(metadata.SubscriptionID, cred, nil) returns a non-nil error — most commonly a subscription ID that fails arm client validation (empty or non-UUID format).","commonSituations":"SubscriptionID from IMDS is malformed (corrupt/partial IMDS response); a fork or older SDK version with stricter client validation; passing an unexpected SubscriptionID format to the armcompute client.","solutions":["Print/verify metadata.SubscriptionID is a well-formed GUID","Re-run the IMDS query and confirm subscriptionId is correct: curl -H Metadata:true 'http://169.254.169.254/metadata/instance/compute?api-version=2021-02-01'","Check the azure-sdk-for-go SDK version in go.mod; pin a known-good version of sdk/resourcemanager/compute/armcompute","Inspect the wrapped error message for the exact validation that failed"],"exampleFix":null,"handlingStrategy":"validation","validationCode":"if _, err := uuid.Parse(subscriptionID); err != nil {\n    return fmt.Errorf(\"invalid azure subscription ID %q: %w\", subscriptionID, err)\n}","typeGuard":null,"tryCatchPattern":"if err != nil {\n    return fmt.Errorf(\"creating VMs client: %w\", err) // inspect wrapped validation error\n}","preventionTips":["Verify the subscription ID is a well-formed GUID before building clients","Re-query IMDS if the subscription looks corrupt","Pin a known-good azure-sdk-for-go version in go.mod"],"tags":["azure","sdk","configuration","subscription"],"backgroundTag":"azure-sdk-client-initialization-failed","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T07:17:12.445Z"}