kubernetes/kops · error

creating an identity: %w

Error message

creating an identity: %w

What it means

azidentity.NewDefaultAzureCredential could not construct a credential chain (managed identity, environment, CLI, etc.). The verifier wraps the underlying azidentity error, meaning it found no usable token source for calling the Azure management APIs.

Source

Thrown at upup/pkg/fi/cloudup/azure/verifier.go:308

// newVerifierClient builds Azure API clients scoped to the local instance's subscription and
// resource group from IMDS metadata.
func newVerifierClient(ctx context.Context) (*client, error) {
	metadata, err := azuremetadata.QueryComputeInstanceMetadata(ctx)
	if err != nil || metadata == nil {
		return nil, fmt.Errorf("getting instance metadata: %w", err)
	}
	if metadata.ResourceGroupName == "" {
		return nil, fmt.Errorf("empty resource group name")
	}
	if metadata.SubscriptionID == "" {
		return nil, fmt.Errorf("empty subscription ID")
	}
	klog.V(4).Infof("Azure verifier client using subscription %q resource group %q", metadata.SubscriptionID, metadata.ResourceGroupName)

	cred, err := azidentity.NewDefaultAzureCredential(nil)
	if err != nil {
		return nil, fmt.Errorf("creating an identity: %w", err)
	}

	nisClient, err := network.NewInterfacesClient(metadata.SubscriptionID, cred, nil)
	if err != nil {
		return nil, fmt.Errorf("creating interfaces client: %w", err)
	}
	vmsClient, err := compute.NewVirtualMachinesClient(metadata.SubscriptionID, cred, nil)
	if err != nil {
		return nil, fmt.Errorf("creating VMs client: %w", err)
	}
	vmssVMsClient, err := compute.NewVirtualMachineScaleSetVMsClient(metadata.SubscriptionID, cred, nil)
	if err != nil {
		return nil, fmt.Errorf("creating VMSSVMs client: %w", err)
	}

	return &client{
		subscriptionID: metadata.SubscriptionID,
		resourceGroup:  metadata.ResourceGroupName,

View on GitHub (pinned to 4c8573c808)

Solutions

  1. Assign a managed identity to the VM and grant it Reader/Contributor on the cluster resource group: az vm identity assign -g rg -n node1
  2. Check for stray AZURE_* env vars that break the credential chain (AZURE_CLIENT_ID set without matching secret/cert)
  3. On a dev machine run `az login` so the CLI credential in the chain works
  4. Review the wrapped azidentity message for which chained credential failed

Example fix

// before: no identity
$ az vm show -g rg -n node1 --query identity  # null
// after
$ az vm identity assign -g rg -n node1
$ az role assignment create --assignee <principal-id> --role Contributor --scope /subscriptions/<sub>/resourceGroups/<rg>
Defensive patterns

Strategy: try-catch

Validate before calling

// Pre-flight: ensure a managed identity exists on this VM
ident, err := azidentity.NewManagedIdentityCredential(nil)
if err != nil { log.Fatal("no usable Azure credential on this VM: ", err) }
// and no conflicting env vars
for _, k := range []string{"AZURE_CLIENT_ID","AZURE_TENANT_ID","AZURE_CLIENT_SECRET"} {
	if os.Getenv(k) != "" { log.Printf("warning: %s set; DefaultAzureCredential chain altered", k) }
}

Try / catch

_, err := newVerifierClient(ctx)
var respErr *azidentity.AuthenticationFailedError
if err != nil {
	if errors.As(err, &respErr) {
		// credential chain failed: check managed identity assignment & RBAC, then retry after fixing
	}
	return err
}

Prevention

When it happens

Trigger: DefaultAzureCredential iterates its chain on first GetToken; NewDefaultAzureCredential itself errors only for invalid options/environment (e.g. malformed AZURE_CLIENT_CERTIFICATE_PATH, bad AZURE_TENANT_ID/AZURE_CLIENT_ID combo), while actual auth failures surface later — but wrapped causes here typically indicate no managed identity assigned to the VM.

Common situations: VM has no system/user-assigned managed identity with rights on the cluster resource group; kOps-created VMs expected to use managed identity but identity not yet assigned; CI running locally without az login; conflicting AZURE_* environment variables (e.g. AZURE_CLIENT_ID without AZURE_CLIENT_SECRET path).

Related errors

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/62b806a80aed3964. Report an issue: GitHub.