kubernetes/kops · error

error building openstack provider client: %v

Error message

error building openstack provider client: %v

What it means

NewOpenstackCloud calls gophercloud's openstack.NewClient(authOption.IdentityEndpoint) to construct a raw ProviderClient (upup/pkg/fi/cloudup/openstack/cloud.go:346). NewClient only fails when the IdentityEndpoint URL cannot be parsed into a valid URL structure, so this error indicates a syntactically invalid Keystone endpoint, not a network or auth problem.

Source

Thrown at upup/pkg/fi/cloudup/openstack/cloud.go:346

	region, err := config.GetRegion()
	if err != nil {
		return nil, fmt.Errorf("error finding openstack region: %v", err)
	}

	raw := openstackCloudInstances[region]
	if raw != nil {
		return raw, nil
	}

	authOption, err := config.GetCredential()
	if err != nil {
		return nil, err
	}

	provider, err := openstack.NewClient(authOption.IdentityEndpoint)
	if err != nil {
		return nil, fmt.Errorf("error building openstack provider client: %v", err)
	}
	ua := gophercloud.UserAgent{}
	ua.Prepend(fmt.Sprintf("kops/%s", uagent))
	provider.UserAgent = ua
	klog.V(4).Infof("Using user-agent %s", ua.Join())

	if cluster != nil && cluster.Spec.CloudProvider.Openstack != nil && cluster.Spec.CloudProvider.Openstack.InsecureSkipVerify != nil {
		tlsconfig := &tls.Config{}
		tlsconfig.InsecureSkipVerify = fi.ValueOf(cluster.Spec.CloudProvider.Openstack.InsecureSkipVerify)
		transport := &http.Transport{TLSClientConfig: tlsconfig}
		provider.HTTPClient = http.Client{
			Transport: transport,
		}
	}

	klog.V(2).Info("authenticating to keystone")

	err = openstack.Authenticate(context.TODO(), provider, authOption)

View on GitHub (pinned to 4c8573c808)

Solutions

1. Print and inspect OS_AUTH_URL; fix the URL so it is absolute and well-formed, e.g. https://identity.example.com:5000/v3
2. Re-source the openrc file after correcting it and confirm with `echo $OS_AUTH_URL`
3. Check the kops cluster/config OpenStack authentication block for the identityEndpoint value if not using env vars

Example fix

// before
export OS_AUTH_URL=keystone.internal:5000/v3
// after
export OS_AUTH_URL=https://keystone.internal:5000/v3

authURL := os.Getenv("OS_AUTH_URL")
u, err := url.Parse(strings.TrimSpace(authURL))
if err != nil || u.Scheme == "" || u.Host == "" {
    return fmt.Errorf("OS_AUTH_URL %q is not a valid absolute URL", authURL)
}
return nil

When it happens

Trigger: authOption.IdentityEndpoint is empty, contains whitespace, uses an unsupported scheme, or is otherwise an unparseable URL — typically from a malformed OS_AUTH_URL env var or a bad authURL entry in the kops OpenStack config.

Common situations: OS_AUTH_URL typo (e.g. 'http:/auth/v3' with single slash); quotes or trailing spaces picked up from the openrc file; missing protocol prefix ('auth.example.com:5000/v3' without http(s)://); empty OS_AUTH_URL after a partial env export.

Related errors

• invalid channel location: %q
• invalid base channel location: %q
• unable to parse CNI plugin binaries asset URL %q: %v
• failed to find cluster dns zone
• exactly one 'admin' SSH public key can be specified when run

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/f117c1cc7ea7b3df. Report an issue: GitHub.