{"record":{"id":"a1f325d5c68b6174","repo":"kubernetes/kops","slug":"error-building-openstack-authenticated-client-v-a1f325","errorCode":null,"errorMessage":"error building openstack authenticated client: %v","messagePattern":"error building openstack authenticated client: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"util/pkg/vfs/swiftfs.go","lineNumber":76,"sourceCode":"\t\treturn nil, fmt.Errorf(\"error building openstack provider client: %v\", err)\n\t}\n\tua := gophercloud.UserAgent{}\n\tua.Prepend(\"kops/swift\")\n\tpc.UserAgent = ua\n\tklog.V(4).Infof(\"Using user-agent %s\", ua.Join())\n\n\ttlsconfig := &tls.Config{}\n\ttlsconfig.InsecureSkipVerify = config.GetInsecureSkipVerify()\n\ttransport := &http.Transport{TLSClientConfig: tlsconfig}\n\tpc.HTTPClient = http.Client{\n\t\tTransport: transport,\n\t}\n\n\tklog.V(2).Info(\"authenticating to keystone\")\n\n\terr = openstack.Authenticate(ctx, pc, authOption)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"error building openstack authenticated client: %v\", err)\n\t}\n\n\tvar endpointOpt gophercloud.EndpointOpts\n\tif region, err := config.GetRegion(); err != nil {\n\t\tklog.Warningf(\"Retrieving swift configuration from openstack config file: %v\", err)\n\t\tendpointOpt, err = config.GetServiceConfig(\"Swift\")\n\t\tif err != nil {\n\t\t\treturn nil, err\n\t\t}\n\t} else {\n\t\tendpointOpt = gophercloud.EndpointOpts{\n\t\t\tType:   \"object-store\",\n\t\t\tRegion: region,\n\t\t}\n\t}\n\n\tclient, err := openstack.NewObjectStorageV1(pc, endpointOpt)\n\tif err != nil {","sourceCodeStart":58,"sourceCodeEnd":94,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/util/pkg/vfs/swiftfs.go#L58-L94","documentation":"After constructing the provider client, NewSwiftClient authenticates against Keystone via openstack.Authenticate. If Keystone rejects the credentials (bad username/password/domain/project, wrong auth type) or is unreachable, the error is wrapped as 'error building openstack authenticated client'.","triggerScenarios":"getSwiftClient -> NewSwiftClient with invalid or incomplete credentials in OS_* env vars or the openstack config file: wrong password, missing/incorrect user domain or project (tenant) name/id, expired token-based auth.","commonSituations":"Rotated Keystone password not yet updated in the config file, application credential vs password auth mismatch, wrong OS_USER_DOMAIN_NAME/OS_PROJECT_NAME, or keystone service down.","solutions":["Verify credentials with the openstack CLI: openstack auth show or openstack token issue using the same env/config.","Check 'password', 'user'/'user_id', 'domain_name'/'domain_id', 'tenant_name'/'tenant_id' values in the openstack config section.","Confirm keystone endpoint is reachable and healthy (curl <auth-url>/auth/tokens).","Use the wrapped %v cause — 401 means bad credentials, connection refused means endpoint/network issue."],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":"// Sanity-check credentials against keystone before kops runs\nif err := exec.Command(\"openstack\", \"token\", \"issue\").Run(); err != nil {\n\treturn fmt.Errorf(\"openstack credentials rejected: %w\", err)\n}","typeGuard":null,"tryCatchPattern":"client, err := vfs.NewSwiftClient(ctx, authOpt)\nif err != nil {\n\tif strings.Contains(err.Error(), \"401\") {\n\t\treturn fmt.Errorf(\"keystone rejected credentials, check user/password/domain: %w\", err)\n\t}\n\treturn err\n}","preventionTips":["Rotate passwords in the config file immediately after Keystone rotation","Set user domain and project name/id explicitly (OS_USER_DOMAIN_NAME, OS_PROJECT_NAME)","Test with `openstack token issue` before long kops operations","Check keystone service health if errors appear cluster-wide"],"tags":["openstack","keystone","authentication","swift"],"backgroundTag":"openstack-authentication-failed","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T12:17:11.808Z"}