kubernetes/kops · error

error describing oidc provider: %v

Error message

error describing oidc provider: %v

What it means

Returned by IAMOIDCProvider.Find when GetOpenIDConnectProvider fails for one of the provider ARNs returned by ListOpenIDConnectProviders. This blocks kOps from comparing thumbprints/URL/audiences of an existing provider with the desired state.

Source

Thrown at upup/pkg/fi/cloudup/awstasks/iamoidcprovider.go:70

}

func (e *IAMOIDCProvider) Find(c *fi.CloudupContext) (*IAMOIDCProvider, error) {
	ctx := c.Context()
	cloud := awsup.GetCloud(c)

	response, err := cloud.IAM().ListOpenIDConnectProviders(ctx, &iam.ListOpenIDConnectProvidersInput{})
	if err != nil {
		return nil, fmt.Errorf("error listing oidc providers: %v", err)
	}

	providers := response.OpenIDConnectProviderList
	for _, provider := range providers {
		arn := provider.Arn
		descResp, err := cloud.IAM().GetOpenIDConnectProvider(ctx, &iam.GetOpenIDConnectProviderInput{
			OpenIDConnectProviderArn: arn,
		})
		if err != nil {
			return nil, fmt.Errorf("error describing oidc provider: %v", err)
		}
		// AWS does not return the https:// in the url
		actualURL := aws.ToString(descResp.Url)
		if !strings.Contains(actualURL, "://") {
			actualURL = "https://" + actualURL
		}

		if actualURL == fi.ValueOf(e.URL) {

			actual := &IAMOIDCProvider{
				ClientIDs:   descResp.ClientIDList,
				Thumbprints: descResp.ThumbprintList,
				URL:         &actualURL,
				Tags:        mapIAMTagsToMap(descResp.Tags),
				arn:         arn,
			}

			actual.Lifecycle = e.Lifecycle

View on GitHub (pinned to 4c8573c808)

Solutions

1. Add iam:GetOpenIDConnectProvider to the kOps IAM policy.
2. Re-run the command; if a specific ARN 404s, it was deleted concurrently and the next list will exclude it.
3. Check for other automation (e.g. EKS, eksctl) racing on the same account's OIDC providers.
4. Throttle/retry with backoff if the account holds many providers.

// ensure both list and get permissions exist before the discovery loop
required := []string{"iam:ListOpenIDConnectProviders", "iam:GetOpenIDConnectProvider"}
_ = required // validate via simulate-principal-policy

func isNotFound(err error) bool { var ae smithy.APIError; return errors.As(err, &ae) && ae.ErrorCode() == "NoSuchEntityException" }

desc, err := iamClient.GetOpenIDConnectProviderWithContext(ctx, &iam.GetOpenIDConnectProviderInput{OpenIDConnectProviderArn: arn})
if err != nil {
    if isNotFound(err) { continue } // provider vanished between list and get
    return nil, fmt.Errorf("error describing oidc provider: %w", err)
}

When it happens

Trigger: GetOpenIDConnectProvider fails on a listed ARN: missing iam:GetOpenIDConnectProvider permission, the provider was deleted between list and get (NoSuchEntity), or throttling when the account has many providers.

Common situations: Accounts with many OIDC providers (EKS clusters each create one) hitting throttling; a provider deleted concurrently by another tool; policies listing Get but not List (or vice versa).

Related errors

• error listing oidc providers: %v
• error creating IAMOIDCProvider: %v
• error updating IAMOIDCProvider Thumbprints: %v
• error untagging IAMOIDCProvider: %v
• error tagging IAMOIDCProvider: %v

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/0748a3d6dd9440b4. Report an issue: GitHub.