kubernetes/kops · error

error creating IAMOIDCProvider: %v

Error message

error creating IAMOIDCProvider: %v

What it means

Returned by IAMOIDCProvider.RenderAWS when CreateOpenIDConnectProvider fails while kOps creates the OIDC provider for the cluster's service-account issuer. When no matching provider is found during Find, kOps creates one; this wrapper captures any failure of that creation call.

Source

Thrown at upup/pkg/fi/cloudup/awstasks/iamoidcprovider.go:137

}

func (p *IAMOIDCProvider) RenderAWS(t *awsup.AWSAPITarget, a, e, changes *IAMOIDCProvider) error {
	ctx := context.TODO()
	thumbprints := e.Thumbprints

	if a == nil {
		klog.V(2).Infof("Creating IAMOIDCProvider with Name:%q", *e.Name)

		request := &iam.CreateOpenIDConnectProviderInput{
			ClientIDList:   e.ClientIDs,
			ThumbprintList: thumbprints,
			Url:            e.URL,
			Tags:           mapToIAMTags(e.Tags),
		}

		response, err := t.Cloud.IAM().CreateOpenIDConnectProvider(ctx, request)
		if err != nil {
			return fmt.Errorf("error creating IAMOIDCProvider: %v", err)
		}

		e.arn = response.OpenIDConnectProviderArn
	} else {
		if changes.Thumbprints != nil {
			klog.V(2).Infof("Updating IAMOIDCProvider Thumbprints %q", fi.ValueOf(e.arn))

			request := &iam.UpdateOpenIDConnectProviderThumbprintInput{}
			request.OpenIDConnectProviderArn = a.arn
			request.ThumbprintList = thumbprints

			_, err := t.Cloud.IAM().UpdateOpenIDConnectProviderThumbprint(ctx, request)
			if err != nil {
				return fmt.Errorf("error updating IAMOIDCProvider Thumbprints: %v", err)
			}
		}
		if changes.Tags != nil {
			if len(a.Tags) > 0 {

View on GitHub (pinned to 4c8573c808)

Solutions

1. Check if an OIDC provider for the same issuer URL already exists; if the account limits providers, reuse/reference it instead of creating a new one.
2. Grant iam:CreateOpenIDConnectProvider to the kOps principal.
3. Verify the issuer URL in the cluster spec is a valid https URL and thumbprints are populated.
4. Ensure no concurrent kops apply is creating the same provider.

Example fix

// before: duplicated issuer across clusters without reuse
URL: fi.String("https://shared.example.com") // provider already exists -> error
// after: point both clusters at the existing provider or unique issuers
URL: fi.String("https://discovery-8c1d.example.com")

// pre-check: does a provider for this issuer URL already exist?
list, _ := iamClient.ListOpenIDConnectProvidersWithContext(ctx, &iam.ListOpenIDConnectProvidersInput{})
for _, p := range list.OpenIDConnectProviderList {
    d, _ := iamClient.GetOpenIDConnectProviderWithContext(ctx, &iam.GetOpenIDConnectProviderInput{OpenIDConnectProviderArn: p.Arn})
    if strings.Contains(aws.ToString(d.Url), issuerHost) { return fmt.Errorf("provider for %s already exists: %s", issuerHost, aws.ToString(p.Arn)) }
}

func isDuplicateProvider(err error) bool { var ae smithy.APIError; return errors.As(err, &ae) && (ae.ErrorCode() == "EntityAlreadyExistsException" || ae.ErrorCode() == "InvalidRequestException") }

When it happens

Trigger: CreateOpenIDConnectProvider fails: provider already exists for the same URL (DuplicateOpenIDConnectProvider / EntityAlreadyExists), missing iam:CreateOpenIDConnectProvider permission, invalid URL, or fewer than one thumbprint supplied.

Common situations: Two clusters sharing the same public OIDC endpoint where one was created manually or by another cluster; SCPs denying OIDC provider creation; cluster spec issuer URL typo (not https, wrong host).

Related errors

• error listing oidc providers: %v
• error describing oidc provider: %v
• error updating IAMOIDCProvider Thumbprints: %v
• error untagging IAMOIDCProvider: %v
• error tagging IAMOIDCProvider: %v

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/7300e3d11291bc3d. Report an issue: GitHub.