kubernetes/kops · error

error adding audience %s to IAMOIDCProvider: %v

Error message

error adding audience %s to IAMOIDCProvider: %v

What it means

During RenderAWS, kOps ensures every configured OIDC audience (client ID) is present on the IAM OIDC identity provider by calling AddClientIDToOpenIDConnectProvider. If that AWS API call returns an error, it is wrapped with the failing audience value so the operator knows which client ID could not be added.

Source

Thrown at upup/pkg/fi/cloudup/awstasks/iamoidcprovider.go:208

			for _, elem := range toRemove.List() {
				request := &iam.RemoveClientIDFromOpenIDConnectProviderInput{
					OpenIDConnectProviderArn: a.arn,
					ClientID:                 &elem,
				}
				_, err := t.Cloud.IAM().RemoveClientIDFromOpenIDConnectProvider(ctx, request)
				if err != nil {
					return fmt.Errorf("error removing audience %s to IAMOIDCProvider: %v", elem, err)
				}
			}
			toAdd := expected.Difference(actual)
			for _, elem := range toAdd.List() {
				request := &iam.AddClientIDToOpenIDConnectProviderInput{
					OpenIDConnectProviderArn: a.arn,
					ClientID:                 &elem,
				}
				_, err := t.Cloud.IAM().AddClientIDToOpenIDConnectProvider(ctx, request)
				if err != nil {
					return fmt.Errorf("error adding audience %s to IAMOIDCProvider: %v", elem, err)
				}
			}
		}
	}
	return nil
}

type terraformIAMOIDCProvider struct {
	URL            *string  `cty:"url"`
	ClientIDList   []string `cty:"client_id_list"`
	ThumbprintList []string `cty:"thumbprint_list"`

	AssumeRolePolicy *terraformWriter.Literal `cty:"assume_role_policy"`
	Tags             map[string]string        `cty:"tags"`
}

func (p *IAMOIDCProvider) RenderTerraform(t *terraform.TerraformTarget, a, e, changes *IAMOIDCProvider) error {
	err := t.AddOutputVariable("iam_openid_connect_provider_arn", e.TerraformLink())

View on GitHub (pinned to 4c8573c808)

Solutions

1. Verify the OIDC provider ARN still exists in AWS (aws iam get-open-id-connect-provider) and recreate it if deleted
2. Grant the calling principal iam:AddClientIDToOpenIDConnectProvider on the provider ARN
3. Re-run kOps update/reconcile after fixing permissions; transient throttling errors are retried by re-running
4. Check the audience value matches the cluster's service-account issuer configuration

Example fix

// before: controller policy without OIDC write access
// after
{"Effect":"Allow","Action":["iam:AddClientIDToOpenIDConnectProvider","iam:RemoveClientIDFromOpenIDConnectProvider"],"Resource":"arn:aws:iam::<account>:oidc-provider/<provider>"}

// pre-check the OIDC provider exists and audiences
import "github.com/aws/aws-sdk-go-v2/service/iam"
out, err := iamClient.GetOpenIDConnectProvider(ctx, &iam.GetOpenIDConnectProviderInput{OpenIDConnectProviderArn: arn})
if err != nil { /* provider missing or inaccessible; fix before adding audience */ }

_, err := t.Cloud.IAM().AddClientIDToOpenIDConnectProvider(ctx, request)
var nfe *types.NoSuchEntityException
switch {
case errors.As(err, &nfe):
    klog.Warningf("OIDC provider %s gone; recreate provider then re-run", a.arn)
case err != nil:
    return fmt.Errorf("error adding audience %s to IAMOIDCProvider: %w", elem, err)
}

When it happens

Trigger: AddClientIDToOpenIDConnectProvider fails: OIDC provider ARN does not exist, was deleted out-of-band, audience already exceeds provider limits, throttling, or IAM permission denied for the caller.

Common situations: Cluster created with a provider whose ARN was changed in state; IAM policy of the kOps controller lacks iam:AddClientIDToOpenIDConnectProvider; provider deleted in AWS console while cluster spec still references it; concurrent reconcile racing.

Related errors

• error listing IAM OIDC Providers: %v
• error getting IAM OIDC Provider %q: %w
• error deleting IAM OIDC Provider %v: %v
• error listing oidc providers: %v
• error describing oidc provider: %v

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/106c14fe13338a95. Report an issue: GitHub.