kubernetes/kops · error

creating identity: %w

Error message

creating identity: %w

What it means

newClient builds credentials via azidentity.NewDefaultAzureCredential, which chains environment, managed-identity, and CLI credential sources. If none of these sources can produce a usable token credential, the returned error is wrapped with this message and client creation fails.

Source

Thrown at pkg/nodeidentity/azure/client.go:51

	vmClient       *compute.VirtualMachinesClient
	vmssClient     *compute.VirtualMachineScaleSetVMsClient
}

// newClient returns a new Client.
func newClient() (*client, error) {
	// nodeidentity.Identifier.New does not propagate a context; the IMDS HTTP client's own timeout
	// bounds this call.
	metadata, err := azuremetadata.QueryComputeInstanceMetadata(context.TODO())
	if err != nil {
		return nil, fmt.Errorf("error querying instance metadata: %s", err)
	}
	if metadata.SubscriptionID == "" {
		return nil, fmt.Errorf("empty subscription ID")
	}

	cred, err := azidentity.NewDefaultAzureCredential(nil)
	if err != nil {
		return nil, fmt.Errorf("creating identity: %w", err)
	}

	vmClient, err := compute.NewVirtualMachinesClient(metadata.SubscriptionID, cred, nil)
	if err != nil {
		return nil, fmt.Errorf("creating VMs client: %w", err)
	}

	vmssClient, err := compute.NewVirtualMachineScaleSetVMsClient(metadata.SubscriptionID, cred, nil)
	if err != nil {
		return nil, fmt.Errorf("creating VMSS VMs client: %w", err)
	}

	return &client{
		vmClient:   vmClient,
		vmssClient: vmssClient,
	}, nil
}

View on GitHub (pinned to 4c8573c808)

Solutions

1. Set Azure credential environment variables: AZURE_TENANT_ID, AZURE_CLIENT_ID, AZURE_CLIENT_SECRET (or AZURE_CLIENT_CERTIFICATE_PATH)
2. If running on an Azure VM/VMSS, ensure a managed identity is assigned to the instance
3. If using the CLI credential locally, run az login and set AZURE_TENANT_ID
4. Inspect the wrapped error to see which individual credentials in the chain failed and fix that source

Example fix

# before: no credential env vars -> 'creating identity' fails
# after:
export AZURE_TENANT_ID=xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx
export AZURE_CLIENT_ID=xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx
export AZURE_CLIENT_SECRET=********  # or use managed identity on the VM

for _, v := range []string{"AZURE_TENANT_ID", "AZURE_CLIENT_ID", "AZURE_CLIENT_SECRET"} {
    if os.Getenv(v) == "" && os.Getenv("USE_WORKLOAD_IDENTITY_AUTH") == "" {
        return fmt.Errorf("missing %s and no managed identity available", v)
    }
}

if err != nil {
    return fmt.Errorf("azure credential chain failed: %w", err)
    // the inner error names which chained credential sources were tried
}

When it happens

Trigger: NewDefaultAzureCredential returns a non-nil error — no environment variables (AZURE_TENANT_ID/AZURE_CLIENT_ID/AZURE_CLIENT_SECRET or certificate vars), no accessible managed identity endpoint, and no az CLI login available.

Common situations: Running outside Azure with no service-principal env vars set; missing or mis-typed AZURE_* environment variables; managed identity disabled on the VM; az CLI logged out; a ChainedTokenCredential with zero usable credentials.

Related errors

• DIGITALOCEAN_ACCESS_TOKEN is required
• getting AWS credentials: %w
• error on getting VM ScaleSet: %s
• error getting AWS account ID: %v
• creating role assignments client: %w

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/25a6f5a2910f5a3e. Report an issue: GitHub.