kubernetes/kops · error

creating VMSSVMs client: %w

Error message

creating VMSSVMs client: %w

What it means

This error is wrapped when the kOps Azure verifier fails to construct an Azure SDK compute.VirtualMachineScaleSetVMsClient for the cluster's subscription. The underlying azcore/azidentity error (auth failure, bad subscription ID, network problem) is preserved via %w. It aborts NewAzureVerifier before any VMSS instance lookup can happen.

Source

Thrown at upup/pkg/fi/cloudup/azure/verifier.go:321

	}
	klog.V(4).Infof("Azure verifier client using subscription %q resource group %q", metadata.SubscriptionID, metadata.ResourceGroupName)

	cred, err := azidentity.NewDefaultAzureCredential(nil)
	if err != nil {
		return nil, fmt.Errorf("creating an identity: %w", err)
	}

	nisClient, err := network.NewInterfacesClient(metadata.SubscriptionID, cred, nil)
	if err != nil {
		return nil, fmt.Errorf("creating interfaces client: %w", err)
	}
	vmsClient, err := compute.NewVirtualMachinesClient(metadata.SubscriptionID, cred, nil)
	if err != nil {
		return nil, fmt.Errorf("creating VMs client: %w", err)
	}
	vmssVMsClient, err := compute.NewVirtualMachineScaleSetVMsClient(metadata.SubscriptionID, cred, nil)
	if err != nil {
		return nil, fmt.Errorf("creating VMSSVMs client: %w", err)
	}

	return &client{
		subscriptionID: metadata.SubscriptionID,
		resourceGroup:  metadata.ResourceGroupName,
		nisClient:      nisClient,
		vmsClient:      vmsClient,
		vmssVMsClient:  vmssVMsClient,
	}, nil
}

View on GitHub (pinned to 4c8573c808)

Solutions

1. Run az login (or set AZURE_CLIENT_ID/AZURE_TENANT_ID/AZURE_CLIENT_SECRET/AZURE_SUBSCRIPTION_ID) so DefaultAzureCredential can authenticate
2. Verify the subscription ID in the cluster config is a valid 36-char GUID via az account show
3. Check connectivity to management.azure.com (proxy/firewall, HTTPS_PROXY settings)
4. Retry after fixing credentials; inspect the chained error (errors.Unwrap) for the root cause

Example fix

// before: anonymous local run
kops get cluster mycluster --cloud=azure
// after: authenticate first
az login
az account set --subscription 00000000-0000-0000-0000-000000000000
kops get cluster mycluster --cloud=azure

// Go: validate credential/subscription before constructing the client
if metadata.SubscriptionID == "" {
    return fmt.Errorf("AZURE_SUBSCRIPTION_ID must be set")
}
if _, err := cred.GetToken(ctx, policy.TokenRequestOptions{Scopes: []string{"https://management.azure.com/.default"}}); err != nil {
    return fmt.Errorf("azure credentials unusable: %w", err)
}

func isAuthError(err error) bool {
    var respErr *azcore.ResponseError
    return errors.As(err, &respErr) && respErr.StatusCode == http.StatusUnauthorized
}

client, err := newVerifierClient(ctx, metadata, cred)
if err != nil {
    var acerr *azidentity.AuthenticationFailedError
    if errors.As(err, &acerr) {
        return fmt.Errorf("re-authenticate with 'az login' or set AZURE_* env vars: %w", err)
    }
    return fmt.Errorf("verifier client init failed: %w", err)
}

When it happens

Trigger: newVerifierClient calls compute.NewVirtualMachineScaleSetVMsClient(metadata.SubscriptionID, cred, nil) and the SDK returns a non-nil error — typically invalid/absent Azure credentials, an malformed subscription ID, or network/DNS failure reaching the ARM endpoint.

Common situations: Running kops get cluster/verify against an Azure cluster without AZURE_* env vars or a valid az login session; wrong --cloud=azure subscription ID in cluster spec; corporate proxy blocking management.azure.com; expired azidentity.DefaultAzureCredential token cache.

Related errors

• creating virtual networks client: %w
• unmarshalling authorization token data: %w
• incorrect Audience
• incorrect Timestamp %v
• incorrect RequestHash

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/b88af0e9608c51cb. Report an issue: GitHub.