What causes "creating VMs client: %w" in kubernetes/kops?

Print/verify metadata.SubscriptionID is a well-formed GUID

creating VMs client: %w

Error message

creating VMs client: %w

What it means

After credentials are obtained, newClient constructs the armcompute VirtualMachinesClient for the node's subscription. If SDK client construction fails, the underlying error is wrapped with 'creating VMs client'. This is typically an invalid subscription ID format rather than a network issue, since construction is local.

Source

Thrown at pkg/nodeidentity/azure/client.go:56

func newClient() (*client, error) {
	// nodeidentity.Identifier.New does not propagate a context; the IMDS HTTP client's own timeout
	// bounds this call.
	metadata, err := azuremetadata.QueryComputeInstanceMetadata(context.TODO())
	if err != nil {
		return nil, fmt.Errorf("error querying instance metadata: %s", err)
	}
	if metadata.SubscriptionID == "" {
		return nil, fmt.Errorf("empty subscription ID")
	}

	cred, err := azidentity.NewDefaultAzureCredential(nil)
	if err != nil {
		return nil, fmt.Errorf("creating identity: %w", err)
	}

	vmClient, err := compute.NewVirtualMachinesClient(metadata.SubscriptionID, cred, nil)
	if err != nil {
		return nil, fmt.Errorf("creating VMs client: %w", err)
	}

	vmssClient, err := compute.NewVirtualMachineScaleSetVMsClient(metadata.SubscriptionID, cred, nil)
	if err != nil {
		return nil, fmt.Errorf("creating VMSS VMs client: %w", err)
	}

	return &client{
		vmClient:   vmClient,
		vmssClient: vmssClient,
	}, nil
}

func (c *client) getVMTags(ctx context.Context, providerID string) (map[string]*string, error) {
	if !strings.HasPrefix(providerID, "azure://") {
		return nil, fmt.Errorf("unknown providerID : %s", providerID)
	}

View on GitHub (pinned to 4c8573c808)

Solutions

Print/verify metadata.SubscriptionID is a well-formed GUID
Re-run the IMDS query and confirm subscriptionId is correct: curl -H Metadata:true 'http://169.254.169.254/metadata/instance/compute?api-version=2021-02-01'
Check the azure-sdk-for-go SDK version in go.mod; pin a known-good version of sdk/resourcemanager/compute/armcompute
Inspect the wrapped error message for the exact validation that failed

Defensive patterns

Strategy: validation

Validate before calling

if _, err := uuid.Parse(subscriptionID); err != nil {
    return fmt.Errorf("invalid azure subscription ID %q: %w", subscriptionID, err)
}

Try / catch

if err != nil {
    return fmt.Errorf("creating VMs client: %w", err) // inspect wrapped validation error
}

Prevention

Verify the subscription ID is a well-formed GUID before building clients
Re-query IMDS if the subscription looks corrupt
Pin a known-good azure-sdk-for-go version in go.mod

When it happens

Trigger: compute.NewVirtualMachinesClient(metadata.SubscriptionID, cred, nil) returns a non-nil error — most commonly a subscription ID that fails arm client validation (empty or non-UUID format).

Common situations: SubscriptionID from IMDS is malformed (corrupt/partial IMDS response); a fork or older SDK version with stricter client validation; passing an unexpected SubscriptionID format to the armcompute client.

Related errors

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/9335faeed3f1c4db. Report an issue: GitHub.