kubernetes/kops · error

error listing IAM OIDC Providers: %v

Error message

error listing IAM OIDC Providers: %v

What it means

kOps wraps the AWS SDK error from iam.ListOpenIDConnectProviders while enumerating OIDC providers (e.g. for IRSA) to find cluster-owned ones. The whole listing operation fails if this IAM call fails. The cause is always the wrapped err.

Source

Thrown at pkg/resources/aws/aws.go:2136

		resourceTracker.Blocks = append(resourceTracker.Blocks, "iam-role:"+name)

		resourceTrackers = append(resourceTrackers, resourceTracker)
	}

	return resourceTrackers, nil
}

func ListIAMOIDCProviders(cloud fi.Cloud, vpcID, clusterName string) ([]*resources.Resource, error) {
	ctx := context.TODO()
	c := cloud.(awsup.AWSCloud)
	tags := c.Tags()

	var providers []*string
	{
		request := &iam.ListOpenIDConnectProvidersInput{}
		response, err := c.IAM().ListOpenIDConnectProviders(ctx, request)
		if err != nil {
			return nil, fmt.Errorf("error listing IAM OIDC Providers: %v", err)
		}
		for _, provider := range response.OpenIDConnectProviderList {
			arn := provider.Arn
			descReq := &iam.GetOpenIDConnectProviderInput{
				OpenIDConnectProviderArn: arn,
			}
			resp, err := c.IAM().GetOpenIDConnectProvider(ctx, descReq)
			if err != nil {
				if awsup.IsIAMNoSuchEntityException(err) {
					klog.Warningf("could not find IAM OIDC Provider %q. Resource may already have been deleted: %v", aws.ToString(arn), err)
					continue
				} else if awsup.AWSErrorCode(err) == "403" {
					klog.Warningf("failed to determine ownership of %q: %v", aws.ToString(arn), err)
					continue
				}
				return nil, fmt.Errorf("error getting IAM OIDC Provider %q: %w", aws.ToString(arn), err)
			}
			if !matchesIAMTags(tags, resp.Tags) {

View on GitHub (pinned to 4c8573c808)

Solutions

1. Run `aws iam list-open-id-connect-providers` with the same credentials to see the raw error
2. Add iam:ListOpenIDConnectProviders to the caller's policy if AccessDenied
3. Back off and retry if throttled
4. Refresh credentials / fix region config

Example fix

// before
{"Effect":"Allow","Action":["iam:DeleteOpenIDConnectProvider"],"Resource":"*"}
// after: include list permission
{"Effect":"Allow","Action":["iam:ListOpenIDConnectProviders","iam:GetOpenIDConnectProvider","iam:DeleteOpenIDConnectProvider"],"Resource":"*"}

// preflight: confirm credentials and IAM read access
_, err := iamClient.ListOpenIDConnectProviders(ctx, &iam.ListOpenIDConnectProvidersInput{MaxItems: aws.Int32(1)})
if err != nil { return fmt.Errorf("IAM OIDC preflight failed: %w", err) }

func isAccessDenied(err error) bool {
  var ae smithy.APIError
  return errors.As(err, &ae) && strings.Contains(ae.ErrorCode(), "AccessDenied")
}

arns, err := ListClusterOIDCProviders(ctx, cloud, clusterName)
var ae smithy.APIError
if errors.As(err, &ae) {
  switch {
  case strings.Contains(ae.ErrorCode(), "AccessDenied"): klog.Warningf("no IAM OIDC list permission: %v", err)
  default: return err
  }
}

When it happens

Trigger: ListOpenIDConnectProviders fails: throttling, missing iam:ListOpenIDConnectProviders permission (AccessDenied), invalid or expired credentials, network errors.

Common situations: Restricted IAM policies used for least-privilege cluster deletion that omit OIDC listing; shared accounts hitting IAM request throttling; expired CI credentials.

Related errors

• error getting IAM OIDC Provider %q: %w
• error deleting IAM OIDC Provider %v: %v
• error listing oidc providers: %v
• error describing oidc provider: %v
• error creating IAMOIDCProvider: %v

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/defa93734eda8bbd. Report an issue: GitHub.