kubernetes/kops · error

error building openstack authenticated client: %v

Error message

error building openstack authenticated client: %v

What it means

After the ProviderClient is built, NewOpenstackCloud authenticates against Keystone via openstack.Authenticate (upup/pkg/fi/cloudup/openstack/cloud.go:366). This wraps any authentication failure — rejected credentials, bad project/domain scope, unreachable Keystone, or TLS problems — under the message 'error building openstack authenticated client:'.

Source

Thrown at upup/pkg/fi/cloudup/openstack/cloud.go:366

	ua := gophercloud.UserAgent{}
	ua.Prepend(fmt.Sprintf("kops/%s", uagent))
	provider.UserAgent = ua
	klog.V(4).Infof("Using user-agent %s", ua.Join())

	if cluster != nil && cluster.Spec.CloudProvider.Openstack != nil && cluster.Spec.CloudProvider.Openstack.InsecureSkipVerify != nil {
		tlsconfig := &tls.Config{}
		tlsconfig.InsecureSkipVerify = fi.ValueOf(cluster.Spec.CloudProvider.Openstack.InsecureSkipVerify)
		transport := &http.Transport{TLSClientConfig: tlsconfig}
		provider.HTTPClient = http.Client{
			Transport: transport,
		}
	}

	klog.V(2).Info("authenticating to keystone")

	err = openstack.Authenticate(context.TODO(), provider, authOption)
	if err != nil {
		return nil, fmt.Errorf("error building openstack authenticated client: %v", err)
	}

	if cluster != nil {
		hasDNS := cluster.PublishesDNSRecords()
		tags := map[string]string{
			TagClusterName: cluster.Name,
		}
		return buildClients(provider, tags, cluster.Spec.CloudProvider.Openstack, config, region, hasDNS)
	}
	// used when no cluster is available
	return buildClients(provider, nil, nil, config, region, false)
}

func buildClients(provider *gophercloud.ProviderClient, tags map[string]string, spec *kops.OpenstackSpec, config vfs.OpenstackConfig, region string, hasDNS bool) (OpenstackCloud, error) {
	cinderClient, err := openstack.NewBlockStorageV3(provider, gophercloud.EndpointOpts{
		Type:   "volumev3",
		Region: region,
	})

View on GitHub (pinned to 4c8573c808)

Solutions

1. Run `openstack token issue` with the same environment to reproduce the auth failure and read the exact 401/404 cause
2. Verify all credential vars: OS_AUTH_URL, OS_USERNAME, OS_PASSWORD, OS_PROJECT_NAME, OS_PROJECT_DOMAIN_NAME, OS_USER_DOMAIN_NAME (or OS_APPLICATION_CREDENTIAL_ID/SECRET)
3. If TLS-related, add the Keystone CA to the system trust store or set OS_CACERT to the CA bundle
4. Confirm network reachability: curl -s $OS_AUTH_URL from the machine running kops

// fail fast with the real auth error before kops runs
_, err := openstackAuthProbe() // e.g. `openstack token issue` equivalent
if err != nil {
    return fmt.Errorf("keystone auth pre-check failed: %w", err)
}
return nil

_, err := cloud.Authenticate()
var respErr gophercloud.ErrDefaultResponse
if errors.As(err, &respErr) {
    switch respErr.Actual.StatusCode {
    case 401:
        return fmt.Errorf("invalid credentials or scope (401): %w", err)
    case 404:
        return fmt.Errorf("wrong auth URL path/version (404): %w", err)
    }
}
if errors.Is(err, x509.UnknownAuthorityError{}) {
    return fmt.Errorf("untrusted Keystone CA; set OS_CACERT: %w", err)
}
return err

When it happens

Trigger: openstack.Authenticate returns an error when: OS_USERNAME/OS_PASSWORD/OS_PROJECT_NAME (or application credential ID/secret) are wrong; the project or user domain is misconfigured; the Keystone host is unreachable or its certificate is untrusted; the auth URL points to the wrong API version path.

Common situations: Expired or rotated OpenStack passwords; missing OS_PROJECT_DOMAIN_NAME/OS_USER_DOMAIN_NAME causing 401; self-signed Keystone CA not in the trust store; firewall blocking the identity endpoint from the CI runner; using v2 auth URLs with a client expecting v3.

Understand the failure class

• Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

Related errors

• error building openstack authenticated client: %v
• DIGITALOCEAN_ACCESS_TOKEN is required
• getting AWS credentials: %w
• creating identity: %w
• error getting AWS account ID: %v

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/ba64d7170db49192. Report an issue: GitHub.