{"record":{"id":"f117c1cc7ea7b3df","repo":"kubernetes/kops","slug":"error-building-openstack-provider-client-v-f117c1","errorCode":null,"errorMessage":"error building openstack provider client: %v","messagePattern":"error building openstack provider client: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"upup/pkg/fi/cloudup/openstack/cloud.go","lineNumber":346,"sourceCode":"\n\tregion, err := config.GetRegion()\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"error finding openstack region: %v\", err)\n\t}\n\n\traw := openstackCloudInstances[region]\n\tif raw != nil {\n\t\treturn raw, nil\n\t}\n\n\tauthOption, err := config.GetCredential()\n\tif err != nil {\n\t\treturn nil, err\n\t}\n\n\tprovider, err := openstack.NewClient(authOption.IdentityEndpoint)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"error building openstack provider client: %v\", err)\n\t}\n\tua := gophercloud.UserAgent{}\n\tua.Prepend(fmt.Sprintf(\"kops/%s\", uagent))\n\tprovider.UserAgent = ua\n\tklog.V(4).Infof(\"Using user-agent %s\", ua.Join())\n\n\tif cluster != nil && cluster.Spec.CloudProvider.Openstack != nil && cluster.Spec.CloudProvider.Openstack.InsecureSkipVerify != nil {\n\t\ttlsconfig := &tls.Config{}\n\t\ttlsconfig.InsecureSkipVerify = fi.ValueOf(cluster.Spec.CloudProvider.Openstack.InsecureSkipVerify)\n\t\ttransport := &http.Transport{TLSClientConfig: tlsconfig}\n\t\tprovider.HTTPClient = http.Client{\n\t\t\tTransport: transport,\n\t\t}\n\t}\n\n\tklog.V(2).Info(\"authenticating to keystone\")\n\n\terr = openstack.Authenticate(context.TODO(), provider, authOption)","sourceCodeStart":328,"sourceCodeEnd":364,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/upup/pkg/fi/cloudup/openstack/cloud.go#L328-L364","documentation":"NewOpenstackCloud calls gophercloud's openstack.NewClient(authOption.IdentityEndpoint) to construct a raw ProviderClient (upup/pkg/fi/cloudup/openstack/cloud.go:346). NewClient only fails when the IdentityEndpoint URL cannot be parsed into a valid URL structure, so this error indicates a syntactically invalid Keystone endpoint, not a network or auth problem.","triggerScenarios":"authOption.IdentityEndpoint is empty, contains whitespace, uses an unsupported scheme, or is otherwise an unparseable URL — typically from a malformed OS_AUTH_URL env var or a bad authURL entry in the kops OpenStack config.","commonSituations":"OS_AUTH_URL typo (e.g. 'http:/auth/v3' with single slash); quotes or trailing spaces picked up from the openrc file; missing protocol prefix ('auth.example.com:5000/v3' without http(s)://); empty OS_AUTH_URL after a partial env export.","solutions":["Print and inspect OS_AUTH_URL; fix the URL so it is absolute and well-formed, e.g. https://identity.example.com:5000/v3","Re-source the openrc file after correcting it and confirm with `echo $OS_AUTH_URL`","Check the kops cluster/config OpenStack authentication block for the identityEndpoint value if not using env vars"],"exampleFix":"// before\nexport OS_AUTH_URL=keystone.internal:5000/v3\n// after\nexport OS_AUTH_URL=https://keystone.internal:5000/v3","handlingStrategy":"validation","validationCode":"authURL := os.Getenv(\"OS_AUTH_URL\")\nu, err := url.Parse(strings.TrimSpace(authURL))\nif err != nil || u.Scheme == \"\" || u.Host == \"\" {\n    return fmt.Errorf(\"OS_AUTH_URL %q is not a valid absolute URL\", authURL)\n}\nreturn nil","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Quote URL values in openrc files to avoid shell artifacts","Always include the scheme (https://) and version path (/v3) in OS_AUTH_URL","Trim whitespace when reading the endpoint from config files","Test with curl $OS_AUTH_URL before running kops"],"tags":["openstack","keystone","url-parsing","configuration"],"backgroundTag":"invalid-endpoint-url","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T12:17:11.808Z"}