kubernetes/kops · error

error building openstack authenticated client: %v

Error message

error building openstack authenticated client: %v

What it means

Wraps a failure of openstack.Authenticate against Keystone in the Designate provider: credentials were loaded and the client built, but the authentication request itself was rejected (bad username/password/application credentials or unreachable Keystone).

Source

Thrown at dnsprovider/pkg/dnsprovider/providers/openstack/designate/designate.go:76

		return nil, fmt.Errorf("error building openstack provider client: %v", err)
	}
	ua := gophercloud.UserAgent{}
	ua.Prepend("kops/designate")
	provider.UserAgent = ua
	klog.V(4).Infof("Using user-agent %s", ua.Join())

	tlsconfig := &tls.Config{}
	tlsconfig.InsecureSkipVerify = oc.GetInsecureSkipVerify()
	transport := &http.Transport{TLSClientConfig: tlsconfig}
	provider.HTTPClient = http.Client{
		Transport: transport,
	}

	klog.V(2).Info("authenticating to keystone")

	err = openstack.Authenticate(context.TODO(), provider, ao)
	if err != nil {
		return nil, fmt.Errorf("error building openstack authenticated client: %v", err)
	}

	sc, err := openstack.NewDNSV2(provider, gophercloud.EndpointOpts{
		Type:   "dns",
		Region: region,
	})
	if err != nil {
		return nil, fmt.Errorf("error creating a ServiceClient: %v", err)
	}
	return New(sc), nil
}

View on GitHub (pinned to 4c8573c808)

Solutions

1. Verify OS_USERNAME/OS_PASSWORD or application credentials
2. Check Keystone reachability and TLS settings
3. Confirm the project/domain scope

When it happens

Trigger: Thrown at dnsprovider/pkg/dnsprovider/providers/openstack/designate/designate.go:76 when the library encounters an invalid state.

Common situations: See trigger scenarios.

Understand the failure class

• Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/a81de1326a671081. Report an issue: GitHub.