{"record":{"id":"b88af0e9608c51cb","repo":"kubernetes/kops","slug":"creating-vmssvms-client-w","errorCode":null,"errorMessage":"creating VMSSVMs client: %w","messagePattern":"creating VMSSVMs client: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"upup/pkg/fi/cloudup/azure/verifier.go","lineNumber":321,"sourceCode":"\t}\n\tklog.V(4).Infof(\"Azure verifier client using subscription %q resource group %q\", metadata.SubscriptionID, metadata.ResourceGroupName)\n\n\tcred, err := azidentity.NewDefaultAzureCredential(nil)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"creating an identity: %w\", err)\n\t}\n\n\tnisClient, err := network.NewInterfacesClient(metadata.SubscriptionID, cred, nil)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"creating interfaces client: %w\", err)\n\t}\n\tvmsClient, err := compute.NewVirtualMachinesClient(metadata.SubscriptionID, cred, nil)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"creating VMs client: %w\", err)\n\t}\n\tvmssVMsClient, err := compute.NewVirtualMachineScaleSetVMsClient(metadata.SubscriptionID, cred, nil)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"creating VMSSVMs client: %w\", err)\n\t}\n\n\treturn &client{\n\t\tsubscriptionID: metadata.SubscriptionID,\n\t\tresourceGroup:  metadata.ResourceGroupName,\n\t\tnisClient:      nisClient,\n\t\tvmsClient:      vmsClient,\n\t\tvmssVMsClient:  vmssVMsClient,\n\t}, nil\n}\n","sourceCodeStart":303,"sourceCodeEnd":332,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/upup/pkg/fi/cloudup/azure/verifier.go#L303-L332","documentation":"This error is wrapped when the kOps Azure verifier fails to construct an Azure SDK compute.VirtualMachineScaleSetVMsClient for the cluster's subscription. The underlying azcore/azidentity error (auth failure, bad subscription ID, network problem) is preserved via %w. It aborts NewAzureVerifier before any VMSS instance lookup can happen.","triggerScenarios":"newVerifierClient calls compute.NewVirtualMachineScaleSetVMsClient(metadata.SubscriptionID, cred, nil) and the SDK returns a non-nil error — typically invalid/absent Azure credentials, an malformed subscription ID, or network/DNS failure reaching the ARM endpoint.","commonSituations":"Running kops get cluster/verify against an Azure cluster without AZURE_* env vars or a valid az login session; wrong --cloud=azure subscription ID in cluster spec; corporate proxy blocking management.azure.com; expired azidentity.DefaultAzureCredential token cache.","solutions":["Run az login (or set AZURE_CLIENT_ID/AZURE_TENANT_ID/AZURE_CLIENT_SECRET/AZURE_SUBSCRIPTION_ID) so DefaultAzureCredential can authenticate","Verify the subscription ID in the cluster config is a valid 36-char GUID via az account show","Check connectivity to management.azure.com (proxy/firewall, HTTPS_PROXY settings)","Retry after fixing credentials; inspect the chained error (errors.Unwrap) for the root cause"],"exampleFix":"// before: anonymous local run\nkops get cluster mycluster --cloud=azure\n// after: authenticate first\naz login\naz account set --subscription 00000000-0000-0000-0000-000000000000\nkops get cluster mycluster --cloud=azure","handlingStrategy":"try-catch","validationCode":"// Go: validate credential/subscription before constructing the client\nif metadata.SubscriptionID == \"\" {\n    return fmt.Errorf(\"AZURE_SUBSCRIPTION_ID must be set\")\n}\nif _, err := cred.GetToken(ctx, policy.TokenRequestOptions{Scopes: []string{\"https://management.azure.com/.default\"}}); err != nil {\n    return fmt.Errorf(\"azure credentials unusable: %w\", err)\n}","typeGuard":"func isAuthError(err error) bool {\n    var respErr *azcore.ResponseError\n    return errors.As(err, &respErr) && respErr.StatusCode == http.StatusUnauthorized\n}","tryCatchPattern":"client, err := newVerifierClient(ctx, metadata, cred)\nif err != nil {\n    var acerr *azidentity.AuthenticationFailedError\n    if errors.As(err, &acerr) {\n        return fmt.Errorf(\"re-authenticate with 'az login' or set AZURE_* env vars: %w\", err)\n    }\n    return fmt.Errorf(\"verifier client init failed: %w\", err)\n}","preventionTips":["Always set AZURE_SUBSCRIPTION_ID and run az login (or a service principal) before kops azure commands","Validate the subscription ID format (GUID) before client construction","Use Managed Identity in CI where possible instead of expired env credentials","Log the full wrapped error chain for root-cause triage"],"tags":["azure","go","client-init","authentication"],"backgroundTag":"azure-sdk-client-creation-failed","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T12:17:11.808Z"}