What causes "creating an identity: %w" in kubernetes/kops?

Assign a managed identity to the VM and grant it Reader/Contributor on the cluster resource group: az vm identity assign -g rg -n node1

kubernetes/kops · error

creating an identity

Error message

creating an identity: %w

What it means

azidentity.NewDefaultAzureCredential could not construct a credential chain (managed identity, environment, CLI, etc.). The verifier wraps the underlying azidentity error, meaning it found no usable token source for calling the Azure management APIs.

Solutions

Assign a managed identity to the VM and grant it Reader/Contributor on the cluster resource group: az vm identity assign -g rg -n node1
Check for stray AZURE_* env vars that break the credential chain (AZURE_CLIENT_ID set without matching secret/cert)
On a dev machine run `az login` so the CLI credential in the chain works
Review the wrapped azidentity message for which chained credential failed

Example fix

// before: no identity
$ az vm show -g rg -n node1 --query identity  # null
// after
$ az vm identity assign -g rg -n node1
$ az role assignment create --assignee <principal-id> --role Contributor --scope /subscriptions/<sub>/resourceGroups/<rg>

Defensive patterns

Strategy: try-catch

Validate before calling

// Pre-flight: ensure a managed identity exists on this VM
ident, err := azidentity.NewManagedIdentityCredential(nil)
if err != nil { log.Fatal("no usable Azure credential on this VM: ", err) }
// and no conflicting env vars
for _, k := range []string{"AZURE_CLIENT_ID","AZURE_TENANT_ID","AZURE_CLIENT_SECRET"} {
	if os.Getenv(k) != "" { log.Printf("warning: %s set; DefaultAzureCredential chain altered", k) }
}

Try / catch

_, err := newVerifierClient(ctx)
var respErr *azidentity.AuthenticationFailedError
if err != nil {
	if errors.As(err, &respErr) {
		// credential chain failed: check managed identity assignment & RBAC, then retry after fixing
	}
	return err
}

Prevention

Always assign a managed identity to kops Azure nodes with RBAC on the cluster resource group
Avoid scattering AZURE_* env vars on nodes
Run `az login` on dev machines before local verification
Grant the identity Reader/Contributor on the resource group at cluster creation

When it happens

Trigger: DefaultAzureCredential iterates its chain on first GetToken; NewDefaultAzureCredential itself errors only for invalid options/environment (e.g. malformed AZURE_CLIENT_CERTIFICATE_PATH, bad AZURE_TENANT_ID/AZURE_CLIENT_ID combo), while actual auth failures surface later — but wrapped causes here typically indicate no managed identity assigned to the VM.

Common situations: VM has no system/user-assigned managed identity with rights on the cluster resource group; kOps-created VMs expected to use managed identity but identity not yet assigned; CI running locally without az login; conflicting AZURE_* environment variables (e.g. AZURE_CLIENT_ID without AZURE_CLIENT_SECRET path).

Related errors

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/62b806a80aed3964. Report an issue: GitHub.

Appendix: source

Thrown at upup/pkg/fi/cloudup/azure/verifier.go:308

// newVerifierClient builds Azure API clients scoped to the local instance's subscription and
// resource group from IMDS metadata.
func newVerifierClient(ctx context.Context) (*client, error) {
	metadata, err := azuremetadata.QueryComputeInstanceMetadata(ctx)
	if err != nil || metadata == nil {
		return nil, fmt.Errorf("getting instance metadata: %w", err)
	}
	if metadata.ResourceGroupName == "" {
		return nil, fmt.Errorf("empty resource group name")
	}
	if metadata.SubscriptionID == "" {
		return nil, fmt.Errorf("empty subscription ID")
	}
	klog.V(4).Infof("Azure verifier client using subscription %q resource group %q", metadata.SubscriptionID, metadata.ResourceGroupName)

	cred, err := azidentity.NewDefaultAzureCredential(nil)
	if err != nil {
		return nil, fmt.Errorf("creating an identity: %w", err)
	}

	nisClient, err := network.NewInterfacesClient(metadata.SubscriptionID, cred, nil)
	if err != nil {
		return nil, fmt.Errorf("creating interfaces client: %w", err)
	}
	vmsClient, err := compute.NewVirtualMachinesClient(metadata.SubscriptionID, cred, nil)
	if err != nil {
		return nil, fmt.Errorf("creating VMs client: %w", err)
	}
	vmssVMsClient, err := compute.NewVirtualMachineScaleSetVMsClient(metadata.SubscriptionID, cred, nil)
	if err != nil {
		return nil, fmt.Errorf("creating VMSSVMs client: %w", err)
	}

	return &client{
		subscriptionID: metadata.SubscriptionID,
		resourceGroup:  metadata.ResourceGroupName,

View on GitHub (pinned to 4c8573c808)