kubernetes/kops · error

error building openstack provider client: %v

Error message

error building openstack provider client: %v

What it means

NewSwiftClient builds a gophercloud provider client for OpenStack. openstack.NewClient parses the identity endpoint and constructs the HTTP client; a malformed or unreachable-to-parse identity endpoint URL causes this error. It wraps the gophercloud error with %v.

Source

Thrown at util/pkg/vfs/swiftfs.go:58

	"k8s.io/apimachinery/pkg/util/wait"
	"k8s.io/client-go/util/homedir"
	"k8s.io/klog/v2"
	"k8s.io/kops/util/pkg/hashing"
	"k8s.io/kops/util/pkg/vfs/openstackconfig"
)

func NewSwiftClient(ctx context.Context) (*gophercloud.ServiceClient, error) {
	config := OpenstackConfig{}

	// Check if env credentials are valid first
	authOption, err := config.GetCredential()
	if err != nil {
		return nil, err
	}

	pc, err := openstack.NewClient(authOption.IdentityEndpoint)
	if err != nil {
		return nil, fmt.Errorf("error building openstack provider client: %v", err)
	}
	ua := gophercloud.UserAgent{}
	ua.Prepend("kops/swift")
	pc.UserAgent = ua
	klog.V(4).Infof("Using user-agent %s", ua.Join())

	tlsconfig := &tls.Config{}
	tlsconfig.InsecureSkipVerify = config.GetInsecureSkipVerify()
	transport := &http.Transport{TLSClientConfig: tlsconfig}
	pc.HTTPClient = http.Client{
		Transport: transport,
	}

	klog.V(2).Info("authenticating to keystone")

	err = openstack.Authenticate(ctx, pc, authOption)
	if err != nil {
		return nil, fmt.Errorf("error building openstack authenticated client: %v", err)

View on GitHub (pinned to 4c8573c808)

Solutions

1. Set OS_AUTH_URL to a valid keystone endpoint, e.g. export OS_AUTH_URL=https://keystone.example.com:5000/v3.
2. Check the 'identity' value in ~/.openstack/config (or OPENSTACK_CREDENTIAL_FILE) is a full valid URL.
3. Verify with curl that the identity endpoint is reachable: curl <auth-url>.
4. Read the wrapped %v cause for the exact URL parse failure.

Example fix

// before (config)
identity = keystone.example.com:5000/v3
// after
identity = https://keystone.example.com:5000/v3

// Validate the identity endpoint before calling NewSwiftClient
authURL := os.Getenv("OS_AUTH_URL")
if u, err := url.Parse(authURL); err != nil || u.Scheme == "" || u.Host == "" {
	return fmt.Errorf("OS_AUTH_URL %q is not a valid URL", authURL)
}

When it happens

Trigger: getSwiftClient -> NewSwiftClient when authOption.IdentityEndpoint (from OS_* env vars or the openstack config file) is empty, malformed, or not a valid URL.

Common situations: OS_AUTH_URL unset or misspelled (e.g. missing https://), wrong keystone port, or a config file whose 'identity' key contains an invalid URL.

Related errors

• failed to extract storage availability zones: %v
• error building cinder client: %w
• error building neutron client: %w
• error building nova client: %w
• error building glance client: %w

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/04025b8690dec010. Report an issue: GitHub.