{"record":{"id":"d175ebc221191939","repo":"kubernetes/kops","slug":"error-loading-default-aws-config-v","errorCode":null,"errorMessage":"error loading default AWS config: %v","messagePattern":"error loading default AWS config: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"cmd/kops-controller/controllers/awsipam.go","lineNumber":60,"sourceCode":")\n\n// NewAWSIPAMReconciler is the constructor for a IPAMReconciler\nfunc NewAWSIPAMReconciler(ctx context.Context, mgr manager.Manager) (*AWSIPAMReconciler, error) {\n\tklog.Info(\"Starting aws ipam controller\")\n\tr := &AWSIPAMReconciler{\n\t\tclient: mgr.GetClient(),\n\t\tlog:    ctrl.Log.WithName(\"controllers\").WithName(\"IPAM\"),\n\t}\n\n\tcoreClient, err := corev1client.NewForConfig(mgr.GetConfig())\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"error building corev1 client: %v\", err)\n\t}\n\tr.coreV1Client = coreClient\n\n\tconfig, err := awsconfig.LoadDefaultConfig(ctx, awslog.WithAWSLogger())\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"error loading default AWS config: %v\", err)\n\t}\n\n\tmetadata := imds.NewFromConfig(config)\n\n\tresp, err := metadata.GetRegion(ctx, &imds.GetRegionInput{})\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"error querying ec2 metadata service (for region): %v\", err)\n\t}\n\n\tec2Config := config.Copy()\n\tec2Config.Region = resp.Region\n\tr.ec2Client = ec2.NewFromConfig(ec2Config)\n\n\treturn r, nil\n}\n\n// AWSIPAMReconciler observes Node objects, and labels them with the correct labels for the instancegroup\n// This used to be done by the kubelet, but is moving to a central controller for greater security in 1.16","sourceCodeStart":42,"sourceCodeEnd":78,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/cmd/kops-controller/controllers/awsipam.go#L42-L78","documentation":"NewAWSIPAMReconciler calls awsconfig.LoadDefaultConfig (aws-sdk-go-v2) to resolve the AWS credential and region chain. This error is returned when every resolution step in the default chain fails, with the SDK's cause embedded via %v. Without a config the reconciler cannot create its EC2 client.","triggerScenarios":"Calling NewAWSIPAMReconciler when LoadDefaultConfig cannot obtain credentials or base config: no AWS_ACCESS_KEY_ID/AWS_SECRET_ACCESS_KEY, no usable shared-config files, no web-identity token file, or an invalid AWS_REGION/AWS_PROFILE / malformed shared config file.","commonSituations":"Running kops-controller outside AWS without exported credentials; an IRSA service-account annotation pointing to a missing role; a typo'd AWS_PROFILE in ~/.aws/config; malformed shared credentials/config files; SDK v2 requiring AWS_EC2_METADATA_DISABLED=false when IMDS is the only source.","solutions":["Read the %v cause — the SDK names which credential provider(s) failed.","For IRSA on EKS, ensure the service account has the eks.amazonaws.com/role-arn annotation and the pod has AWS_WEB_IDENTITY_TOKEN_FILE and AWS_REGION env vars.","When running off-cluster, export AWS_ACCESS_KEY_ID/AWS_SECRET_ACCESS_KEY (or AWS_PROFILE) and AWS_REGION.","If relying on IMDS, confirm the instance metadata service is reachable (v2 token enabled) and AWS_EC2_METADATA_DISABLED is not set."],"exampleFix":"// before: deployment without AWS config\ncmd: [\"/kops-controller\"]\n// after: IRSA on EKS\nmetadata:\n  annotations:\n    eks.amazonaws.com/role-arn: arn:aws:iam::123456789012:role/kops-controller\nspec:\n  containers:\n  - env:\n    - name: AWS_REGION\n      value: us-east-1","handlingStrategy":"validation","validationCode":"if os.Getenv(\"AWS_REGION\") == \"\" &&\n    os.Getenv(\"AWS_DEFAULT_REGION\") == \"\" &&\n    os.Getenv(\"AWS_WEB_IDENTITY_TOKEN_FILE\") == \"\" &&\n    os.Getenv(\"AWS_ACCESS_KEY_ID\") == \"\" {\n    return fmt.Errorf(\"no AWS region or credential source configured (set AWS_REGION or IRSA env)\")\n}","typeGuard":null,"tryCatchPattern":"rec, err := NewAWSIPAMReconciler(ctx, mgr)\nif err != nil {\n    var cErr *aws.CredentialsCacheError\n    if strings.Contains(err.Error(), \"error loading default AWS config\") {\n        return fmt.Errorf(\"AWS config chain failed: check credentials/region env or IRSA role: %w\", err)\n    }\n    _ = cErr\n    return err\n}","preventionTips":["Use IRSA (service-account role annotation) when running on EKS, and set AWS_REGION on the pod.","Keep shared credentials/config files well-formed when running off-cluster.","Do not set AWS_EC2_METADATA_DISABLED unless credentials come from another chain link.","Fail fast with an env precheck at controller startup before wiring the reconciler."],"tags":["aws","credentials","aws-sdk-go-v2","controller"],"backgroundTag":"aws-credentials-not-found","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T12:17:11.808Z"}