kubernetes/kops · error

error building openstack authenticated client: %v

Error message

error building openstack authenticated client: %v

What it means

After constructing the provider client, NewSwiftClient authenticates against Keystone via openstack.Authenticate. If Keystone rejects the credentials (bad username/password/domain/project, wrong auth type) or is unreachable, the error is wrapped as 'error building openstack authenticated client'.

Source

Thrown at util/pkg/vfs/swiftfs.go:76

		return nil, fmt.Errorf("error building openstack provider client: %v", err)
	}
	ua := gophercloud.UserAgent{}
	ua.Prepend("kops/swift")
	pc.UserAgent = ua
	klog.V(4).Infof("Using user-agent %s", ua.Join())

	tlsconfig := &tls.Config{}
	tlsconfig.InsecureSkipVerify = config.GetInsecureSkipVerify()
	transport := &http.Transport{TLSClientConfig: tlsconfig}
	pc.HTTPClient = http.Client{
		Transport: transport,
	}

	klog.V(2).Info("authenticating to keystone")

	err = openstack.Authenticate(ctx, pc, authOption)
	if err != nil {
		return nil, fmt.Errorf("error building openstack authenticated client: %v", err)
	}

	var endpointOpt gophercloud.EndpointOpts
	if region, err := config.GetRegion(); err != nil {
		klog.Warningf("Retrieving swift configuration from openstack config file: %v", err)
		endpointOpt, err = config.GetServiceConfig("Swift")
		if err != nil {
			return nil, err
		}
	} else {
		endpointOpt = gophercloud.EndpointOpts{
			Type:   "object-store",
			Region: region,
		}
	}

	client, err := openstack.NewObjectStorageV1(pc, endpointOpt)
	if err != nil {

View on GitHub (pinned to 4c8573c808)

Solutions

1. Verify credentials with the openstack CLI: openstack auth show or openstack token issue using the same env/config.
2. Check 'password', 'user'/'user_id', 'domain_name'/'domain_id', 'tenant_name'/'tenant_id' values in the openstack config section.
3. Confirm keystone endpoint is reachable and healthy (curl <auth-url>/auth/tokens).
4. Use the wrapped %v cause — 401 means bad credentials, connection refused means endpoint/network issue.

// Sanity-check credentials against keystone before kops runs
if err := exec.Command("openstack", "token", "issue").Run(); err != nil {
	return fmt.Errorf("openstack credentials rejected: %w", err)
}

client, err := vfs.NewSwiftClient(ctx, authOpt)
if err != nil {
	if strings.Contains(err.Error(), "401") {
		return fmt.Errorf("keystone rejected credentials, check user/password/domain: %w", err)
	}
	return err
}

When it happens

Trigger: getSwiftClient -> NewSwiftClient with invalid or incomplete credentials in OS_* env vars or the openstack config file: wrong password, missing/incorrect user domain or project (tenant) name/id, expired token-based auth.

Common situations: Rotated Keystone password not yet updated in the config file, application credential vs password auth mismatch, wrong OS_USER_DOMAIN_NAME/OS_PROJECT_NAME, or keystone service down.

Understand the failure class

• Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

Related errors

• error building openstack authenticated client: %v
• error building openstack provider client: %v
• unable to fetch metadata: %w
• error building nova client: %v
• failed to get info for server %q: %w

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/a1f325d5c68b6174. Report an issue: GitHub.