kubernetes/kops · error

error getting IAM OIDC Provider %q: %w

Error message

error getting IAM OIDC Provider %q: %w

What it means

kOps wraps the AWS SDK error from iam.GetOpenIDConnectProvider when fetching tags to determine ownership. NoSuchEntity and 403 are already skipped with warnings, so this is an unexpected per-provider failure (e.g. throttling). Only the current provider's ownership check is aborted because the function returns nil, err.

Source

Thrown at pkg/resources/aws/aws.go:2152

		response, err := c.IAM().ListOpenIDConnectProviders(ctx, request)
		if err != nil {
			return nil, fmt.Errorf("error listing IAM OIDC Providers: %v", err)
		}
		for _, provider := range response.OpenIDConnectProviderList {
			arn := provider.Arn
			descReq := &iam.GetOpenIDConnectProviderInput{
				OpenIDConnectProviderArn: arn,
			}
			resp, err := c.IAM().GetOpenIDConnectProvider(ctx, descReq)
			if err != nil {
				if awsup.IsIAMNoSuchEntityException(err) {
					klog.Warningf("could not find IAM OIDC Provider %q. Resource may already have been deleted: %v", aws.ToString(arn), err)
					continue
				} else if awsup.AWSErrorCode(err) == "403" {
					klog.Warningf("failed to determine ownership of %q: %v", aws.ToString(arn), err)
					continue
				}
				return nil, fmt.Errorf("error getting IAM OIDC Provider %q: %w", aws.ToString(arn), err)
			}
			if !matchesIAMTags(tags, resp.Tags) {
				continue
			}
			providers = append(providers, arn)
		}
	}

	var resourceTrackers []*resources.Resource

	for _, arn := range providers {
		resourceTracker := &resources.Resource{
			Name:    aws.ToString(arn),
			ID:      aws.ToString(arn),
			Type:    "oidc-provider",
			Deleter: DeleteIAMOIDCProvider,
		}
		resourceTrackers = append(resourceTrackers, resourceTracker)

View on GitHub (pinned to 4c8573c808)

Solutions

1. Inspect the wrapped error code (errors.As on *types.NoSuchEntityException or smithy APIError)
2. If throttled, retry with exponential backoff
3. Re-run the operation; if the provider is gone, the error should now be NoSuchEntity and be skipped
4. Verify IAM permissions for iam:GetOpenIDConnectProvider

// preflight one provider Get to confirm permission before scanning all
if len(providers) > 0 {
  _, err := iamClient.GetOpenIDConnectProvider(ctx, &iam.GetOpenIDConnectProviderInput{OpenIDConnectProviderArn: providers[0]})
  if err != nil && awsup.AWSErrorCode(err) != "NoSuchEntity" { return err }
}

func isThrottleOrTransient(err error) bool {
  code := awsup.AWSErrorCode(err)
  return code == "ThrottlingException" || code == "TooManyRequests" || code == "RequestLimitExceeded"
}

arns, err := ListClusterOIDCProviders(ctx, cloud, clusterName)
if err != nil && isThrottleOrTransient(err) {
  // backoff and retry the listing
} else if err != nil {
  return err
}

When it happens

Trigger: GetOpenIDConnectProvider fails with a code other than NoSuchEntity/'403': TooManyRequests throttling, serialized request errors, permissions edge cases where the error code string isn't exactly '403'.

Common situations: Many OIDC providers in the account causing Get-call throttling during listing; provider deleted concurrently with a race not matching NoSuchEntity (rare); restricted STS session policies.

Related errors

• error listing IAM OIDC Providers: %v
• error deleting IAM OIDC Provider %v: %v
• error listing oidc providers: %v
• error describing oidc provider: %v
• error creating IAMOIDCProvider: %v

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/69219abda468d84f. Report an issue: GitHub.