{"record":{"id":"ba64d7170db49192","repo":"kubernetes/kops","slug":"error-building-openstack-authenticated-client-v-ba64d7","errorCode":null,"errorMessage":"error building openstack authenticated client: %v","messagePattern":"error building openstack authenticated client: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"upup/pkg/fi/cloudup/openstack/cloud.go","lineNumber":366,"sourceCode":"\tua := gophercloud.UserAgent{}\n\tua.Prepend(fmt.Sprintf(\"kops/%s\", uagent))\n\tprovider.UserAgent = ua\n\tklog.V(4).Infof(\"Using user-agent %s\", ua.Join())\n\n\tif cluster != nil && cluster.Spec.CloudProvider.Openstack != nil && cluster.Spec.CloudProvider.Openstack.InsecureSkipVerify != nil {\n\t\ttlsconfig := &tls.Config{}\n\t\ttlsconfig.InsecureSkipVerify = fi.ValueOf(cluster.Spec.CloudProvider.Openstack.InsecureSkipVerify)\n\t\ttransport := &http.Transport{TLSClientConfig: tlsconfig}\n\t\tprovider.HTTPClient = http.Client{\n\t\t\tTransport: transport,\n\t\t}\n\t}\n\n\tklog.V(2).Info(\"authenticating to keystone\")\n\n\terr = openstack.Authenticate(context.TODO(), provider, authOption)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"error building openstack authenticated client: %v\", err)\n\t}\n\n\tif cluster != nil {\n\t\thasDNS := cluster.PublishesDNSRecords()\n\t\ttags := map[string]string{\n\t\t\tTagClusterName: cluster.Name,\n\t\t}\n\t\treturn buildClients(provider, tags, cluster.Spec.CloudProvider.Openstack, config, region, hasDNS)\n\t}\n\t// used when no cluster is available\n\treturn buildClients(provider, nil, nil, config, region, false)\n}\n\nfunc buildClients(provider *gophercloud.ProviderClient, tags map[string]string, spec *kops.OpenstackSpec, config vfs.OpenstackConfig, region string, hasDNS bool) (OpenstackCloud, error) {\n\tcinderClient, err := openstack.NewBlockStorageV3(provider, gophercloud.EndpointOpts{\n\t\tType:   \"volumev3\",\n\t\tRegion: region,\n\t})","sourceCodeStart":348,"sourceCodeEnd":384,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/upup/pkg/fi/cloudup/openstack/cloud.go#L348-L384","documentation":"After the ProviderClient is built, NewOpenstackCloud authenticates against Keystone via openstack.Authenticate (upup/pkg/fi/cloudup/openstack/cloud.go:366). This wraps any authentication failure — rejected credentials, bad project/domain scope, unreachable Keystone, or TLS problems — under the message 'error building openstack authenticated client:'.","triggerScenarios":"openstack.Authenticate returns an error when: OS_USERNAME/OS_PASSWORD/OS_PROJECT_NAME (or application credential ID/secret) are wrong; the project or user domain is misconfigured; the Keystone host is unreachable or its certificate is untrusted; the auth URL points to the wrong API version path.","commonSituations":"Expired or rotated OpenStack passwords; missing OS_PROJECT_DOMAIN_NAME/OS_USER_DOMAIN_NAME causing 401; self-signed Keystone CA not in the trust store; firewall blocking the identity endpoint from the CI runner; using v2 auth URLs with a client expecting v3.","solutions":["Run `openstack token issue` with the same environment to reproduce the auth failure and read the exact 401/404 cause","Verify all credential vars: OS_AUTH_URL, OS_USERNAME, OS_PASSWORD, OS_PROJECT_NAME, OS_PROJECT_DOMAIN_NAME, OS_USER_DOMAIN_NAME (or OS_APPLICATION_CREDENTIAL_ID/SECRET)","If TLS-related, add the Keystone CA to the system trust store or set OS_CACERT to the CA bundle","Confirm network reachability: curl -s $OS_AUTH_URL from the machine running kops"],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":"// fail fast with the real auth error before kops runs\n_, err := openstackAuthProbe() // e.g. `openstack token issue` equivalent\nif err != nil {\n    return fmt.Errorf(\"keystone auth pre-check failed: %w\", err)\n}\nreturn nil","typeGuard":null,"tryCatchPattern":"_, err := cloud.Authenticate()\nvar respErr gophercloud.ErrDefaultResponse\nif errors.As(err, &respErr) {\n    switch respErr.Actual.StatusCode {\n    case 401:\n        return fmt.Errorf(\"invalid credentials or scope (401): %w\", err)\n    case 404:\n        return fmt.Errorf(\"wrong auth URL path/version (404): %w\", err)\n    }\n}\nif errors.Is(err, x509.UnknownAuthorityError{}) {\n    return fmt.Errorf(\"untrusted Keystone CA; set OS_CACERT: %w\", err)\n}\nreturn err","preventionTips":["Validate credentials with `openstack token issue` before cluster operations","Set OS_PROJECT_DOMAIN_NAME and OS_USER_DOMAIN_NAME explicitly","Install the Keystone CA cert into the trust store or set OS_CACERT","Rotate credentials in sync with CI secrets storage"],"tags":["openstack","keystone","authentication","credentials"],"backgroundTag":"authentication-failed","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T07:17:12.445Z"}