kubernetes/kops · error

error listing oidc providers: %v

Error message

error listing oidc providers: %v

What it means

Returned by IAMOIDCProvider.Find when ListOpenIDConnectProviders fails, preventing kOps from discovering existing OIDC providers to match against the cluster's service-account issuer. kOps wraps the raw AWS error because any failure here blocks the Find pass entirely.

Source

Thrown at upup/pkg/fi/cloudup/awstasks/iamoidcprovider.go:60

	Name *string
	Tags map[string]string

	arn *string
}

var _ fi.CompareWithID = (*IAMOIDCProvider)(nil)

func (e *IAMOIDCProvider) CompareWithID() *string {
	return e.Name
}

func (e *IAMOIDCProvider) Find(c *fi.CloudupContext) (*IAMOIDCProvider, error) {
	ctx := c.Context()
	cloud := awsup.GetCloud(c)

	response, err := cloud.IAM().ListOpenIDConnectProviders(ctx, &iam.ListOpenIDConnectProvidersInput{})
	if err != nil {
		return nil, fmt.Errorf("error listing oidc providers: %v", err)
	}

	providers := response.OpenIDConnectProviderList
	for _, provider := range providers {
		arn := provider.Arn
		descResp, err := cloud.IAM().GetOpenIDConnectProvider(ctx, &iam.GetOpenIDConnectProviderInput{
			OpenIDConnectProviderArn: arn,
		})
		if err != nil {
			return nil, fmt.Errorf("error describing oidc provider: %v", err)
		}
		// AWS does not return the https:// in the url
		actualURL := aws.ToString(descResp.Url)
		if !strings.Contains(actualURL, "://") {
			actualURL = "https://" + actualURL
		}

		if actualURL == fi.ValueOf(e.URL) {

View on GitHub (pinned to 4c8573c808)

Solutions

1. Add iam:ListOpenIDConnectProviders to the kOps principal's IAM policy.
2. Check region/endpoint configuration in the cluster spec and AWS credentials.
3. Retry the command — throttling is a common transient cause.
4. If using an IAM role/chained credentials, verify the role session has the permission after AssumeRole.

// verify credentials and region before listing
_, err := stsClient.GetCallerIdentityWithContext(ctx, &sts.GetCallerIdentityInput{})
// also ensure the session region matches the cluster region

func isAccessDenied(err error) bool { var ae smithy.APIError; return errors.As(err, &ae) && ae.ErrorCode() == "AccessDeniedException" }

resp, err := iamClient.ListOpenIDConnectProvidersWithContext(ctx, &iam.ListOpenIDConnectProvidersInput{})
if err != nil {
    if isThrottling(err) { return retryWithBackoff(ctx, op) }
    return fmt.Errorf("error listing oidc providers: %w", err)
}

When it happens

Trigger: cloud.IAM().ListOpenIDConnectProviders fails during the Find pass: missing iam:ListOpenIDConnectProviders permission, throttling, or connectivity errors.

Common situations: Least-privilege IAM policies for kOps missing ListOpenIDConnectProviders; corporate proxy/firewall blocking STS/IAM endpoints; region misconfiguration in the kops cluster spec.

Related errors

• error describing oidc provider: %v
• error creating IAMOIDCProvider: %v
• error updating IAMOIDCProvider Thumbprints: %v
• error untagging IAMOIDCProvider: %v
• error tagging IAMOIDCProvider: %v

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/7ce9ced8b9dad044. Report an issue: GitHub.