kubernetes/kops · error

error deleting IAM OIDC Provider %v: %v

Error message

error deleting IAM OIDC Provider %v: %v

What it means

kOps wraps the AWS SDK error from iam.DeleteOpenIDConnectProvider when deleting a cluster-owned OIDC provider. NoSuchEntity is already treated as success (already deleted), so this is a real delete failure such as AccessDenied or throttling. Because deletions are retried by kOps, DependencyApiError-style transient issues may resolve on re-run.

Source

Thrown at pkg/resources/aws/aws.go:2191

	return resourceTrackers, nil
}

func DeleteIAMOIDCProvider(cloud fi.Cloud, r *resources.Resource) error {
	ctx := context.TODO()
	c := cloud.(awsup.AWSCloud)
	arn := new(r.ID)
	{
		klog.V(2).Infof("Deleting IAM OIDC Provider %v", arn)
		request := &iam.DeleteOpenIDConnectProviderInput{
			OpenIDConnectProviderArn: arn,
		}
		_, err := c.IAM().DeleteOpenIDConnectProvider(ctx, request)
		if err != nil {
			if awsup.IsIAMNoSuchEntityException(err) {
				klog.V(2).Infof("Got NoSuchEntity deleting IAM OIDC Provider %v; will treat as already-deleted", arn)
				return nil
			}
			return fmt.Errorf("error deleting IAM OIDC Provider %v: %v", arn, err)
		}
	}

	return nil
}

func ListSpotinstResources(cloud fi.Cloud, vpcID, clusterName string) ([]*resources.Resource, error) {
	return spotinst.ListResources(cloud.(awsup.AWSCloud).Spotinst(), clusterName)
}

func FindName(tags []ec2types.Tag) string {
	if name, found := awsup.FindEC2Tag(tags, "Name"); found {
		return name
	}
	return ""
}

func FindASGName(tags []autoscalingtypes.TagDescription) string {

View on GitHub (pinned to 4c8573c808)

Solutions

1. Run `aws iam delete-open-id-connect-provider --open-id-connect-provider-arn <arn>` manually to see the raw cause
2. Add iam:DeleteOpenIDConnectProvider on the provider ARN to the caller's policy
3. If throttled or transient, re-run `kops delete cluster` — NoSuchEntity paths make deletion idempotent
4. Check for org SCPs / permission boundaries denying iam:Delete*

Example fix

// before: policy without OIDC delete
{"Effect":"Allow","Action":["iam:DeleteRole","iam:DeleteRolePolicy"],"Resource":"*"}
// after
{"Effect":"Allow","Action":["iam:DeleteRole","iam:DeleteRolePolicy","iam:DeleteOpenIDConnectProvider"],"Resource":"*"}

// preflight: check the principal can delete the provider
out, _ := iamClient.SimulatePrincipalPolicy(&iam.SimulatePrincipalPolicyInput{
  PolicySourceArn: aws.String(operatorArn),
  ActionNames: []string{"iam:DeleteOpenIDConnectProvider"},
})
// inspect out.EvaluationResults for denied decisions

func isIAMDeleteDenied(err error) bool {
  return strings.Contains(awsup.AWSErrorCode(err), "AccessDenied") || awsup.AWSErrorCode(err) == "AccessDeniedException"
}

err := DeleteClusterOIDCProviders(ctx, cloud, clusterName)
if err != nil {
  if isIAMDeleteDenied(err) { klog.Warningf("manual cleanup required: %v", err) }
  else { return err }
} // NoSuchEntity is already treated as success inside kOps

When it happens

Trigger: DeleteOpenIDConnectProvider fails with AccessDenied (caller lacks iam:DeleteOpenIDConnectProvider), throttling, or the ARN was concurrently deleted by another process outside the NoSuchEntity window.

Common situations: Least-privilege deletion policies that grant delete on roles/buckets but forget the OIDC provider ARN; two operators running cluster deletion concurrently; org SCPs denying IAM deletes.

Related errors

• error listing IAM OIDC Providers: %v
• error getting IAM OIDC Provider %q: %w
• error listing oidc providers: %v
• error describing oidc provider: %v
• error creating IAMOIDCProvider: %v

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/583d5853f7aa0dc7. Report an issue: GitHub.