kubernetes/kops · error

creating virtual networks client: %w

Error message

creating virtual networks client: %w

What it means

Wrapped when construction of the Azure SDK network.NewVirtualNetworksClient fails inside newVirtualNetworksClientImpl, which is invoked by newAzureCloud. This mirrors error 2440 but for the virtual networks data-plane client; the root cause is almost always credential or subscription problems in DefaultAzureCredential, not the vnet itself.

Source

Thrown at upup/pkg/fi/cloudup/azure/virtualnetwork.go:89

	}
	return l, nil
}

func (c *virtualNetworksClientImpl) Delete(ctx context.Context, resourceGroupName, vnetName string) error {
	future, err := c.c.BeginDelete(ctx, resourceGroupName, vnetName, nil)
	if err != nil {
		return fmt.Errorf("deleting virtual network: %w", err)
	}
	if _, err = future.PollUntilDone(ctx, nil); err != nil {
		return fmt.Errorf("waiting for virtual network deletion completion: %w", err)
	}
	return nil
}

func newVirtualNetworksClientImpl(subscriptionID string, cred *azidentity.DefaultAzureCredential) (*virtualNetworksClientImpl, error) {
	c, err := network.NewVirtualNetworksClient(subscriptionID, cred, nil)
	if err != nil {
		return nil, fmt.Errorf("creating virtual networks client: %w", err)
	}
	return &virtualNetworksClientImpl{
		c: c,
	}, nil
}

View on GitHub (pinned to 4c8573c808)

Solutions

1. Configure credentials: az login or AZURE_CLIENT_ID/AZURE_TENANT_ID/AZURE_CLIENT_SECRET/AZURE_SUBSCRIPTION_ID env vars
2. Validate AZURE_SUBSCRIPTION_ID with az account show --query id
3. Confirm the kops Azure SDK (sdk/resourcemanager/network) versions are consistent after go.mod changes
4. Re-run kops after fixing; unwrap the %w chain for the specific azidentity error code

Example fix

// before: missing env
export AZURE_SUBSCRIPTION_ID=""
// after
export AZURE_SUBSCRIPTION_ID=00000000-0000-0000-0000-000000000000
export AZURE_TENANT_ID=... AZURE_CLIENT_ID=... AZURE_CLIENT_SECRET=...

// Go: validate inputs before newVirtualNetworksClientImpl
if subscriptionID == "" {
    return nil, fmt.Errorf("subscription ID is required")
}
if _, err := uuid.Parse(subscriptionID); err != nil {
    return nil, fmt.Errorf("subscription ID %q is not a valid GUID: %w", subscriptionID, err)
}
if _, err := cred.GetToken(ctx, policy.TokenRequestOptions{Scopes: []string{"https://management.azure.com/.default"}}); err != nil {
    return nil, fmt.Errorf("azure credential chain failed: %w", err)
}

func validSubscriptionID(s string) bool {
    _, err := uuid.Parse(s)
    return err == nil
}

vnets, err := newVirtualNetworksClientImpl(subscriptionID, cred)
if err != nil {
    var iderr *azidentity.CredentialUnavailableError
    if errors.As(err, &iderr) {
        return fmt.Errorf("no Azure credential available; run 'az login' or set AZURE_* env vars: %w", err)
    }
    return err
}

When it happens

Trigger: newVirtualNetworksClientImpl calls network.NewVirtualNetworksClient(subscriptionID, cred, nil) and the SDK returns an error — invalid subscription ID format, credential chain exhausted, or client construction failure (bad pipeline options/endpoint).

Common situations: First-time kops azure setup without any credentials configured; AZURE_SUBSCRIPTION_ID empty or malformed; environment mixing tokens from multiple tenants; SDK version mismatch after a dependency bump.

Related errors

• creating VMSSVMs client: %w
• unmarshalling authorization token data: %w
• incorrect Audience
• incorrect Timestamp %v
• incorrect RequestHash

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/7f28c10e24fa2134. Report an issue: GitHub.