kubernetes/kops · error

creating role assignments client: %w

Error message

creating role assignments client: %w

What it means

This error is wrapped when authz.NewRoleAssignmentsClient fails to construct the Azure SDK RoleAssignmentsClient for the given subscription ID and credential. Failure here means the client object could not be created before any Azure API call is made. It propagates out of newRoleAssignmentsClientImpl during newAzureCloud, aborting cloud initialization.

Source

Thrown at upup/pkg/fi/cloudup/azure/roleassignment.go:77

			return nil, fmt.Errorf("listing role assignments: %w", err)
		}
		l = append(l, resp.Value...)
	}
	return l, nil
}

func (c *roleAssignmentsClientImpl) Delete(ctx context.Context, scope, raName string) error {
	_, err := c.c.Delete(ctx, scope, raName, nil)
	if err != nil {
		return fmt.Errorf("deleting role assignment: %w", err)
	}
	return nil
}

func newRoleAssignmentsClientImpl(subscriptionID string, cred *azidentity.DefaultAzureCredential) (*roleAssignmentsClientImpl, error) {
	c, err := authz.NewRoleAssignmentsClient(subscriptionID, cred, nil)
	if err != nil {
		return nil, fmt.Errorf("creating role assignments client: %w", err)
	}
	return &roleAssignmentsClientImpl{
		c: c,
	}, nil
}

View on GitHub (pinned to 4c8573c808)

Solutions

1. Verify AZURE_SUBSCRIPTION_ID is set to a valid GUID before calling newAzureCloud
2. Ensure DefaultAzureCredential is created successfully and an auth chain exists (env vars, az login, or managed identity)
3. Check the wrapped %w error for the root cause and fix the underlying configuration
4. Confirm the azure-sdk-for-go azidentity and authorization module versions are compatible

Example fix

// before
cloud, err := azure.NewAzureCloud(...)
// after
if os.Getenv("AZURE_SUBSCRIPTION_ID") == "" {
	return fmt.Errorf("AZURE_SUBSCRIPTION_ID must be set")
}
cloud, err := azure.NewAzureCloud(...)

if subID == "" || _, err := uuid.Parse(os.Getenv("AZURE_SUBSCRIPTION_ID")); err != nil {
	return fmt.Errorf("valid AZURE_SUBSCRIPTION_ID required")
}
if _, err := azidentity.NewDefaultAzureCredential(nil); err != nil {
	return fmt.Errorf("no Azure credential available: %w", err)
}

client, err := newAzureCloud(...)
if err != nil {
	var credErr *azidentity.CredentialUnavailableError
	if errors.As(err, &credErr) { /* fix auth env */ }
	return err
}

When it happens

Trigger: authz.NewRoleAssignmentsClient(subscriptionID, cred, nil) returns a non-nil err, typically when subscriptionID is empty/invalid or the credential is nil/invalid for the SDK's pipeline setup.

Common situations: Missing or malformed AZURE_SUBSCRIPTION_ID; DefaultAzureCredential constructed with no available auth source (no env vars, no az login, no managed identity); SDK version mismatch where client constructor validates inputs strictly.

Related errors

• creating route tables client: %w
• creating identity: %w
• DNS not implemented on azureCloud
• FindVPCInfo not implemented on azureCloud, use FindVNetInfo
• DeleteGroup not implemented on azureCloud

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/10e1477c08056d87. Report an issue: GitHub.