kubernetes/kops · error

error loading default AWS config: %v

Error message

error loading default AWS config: %v

What it means

NewAWSIPAMReconciler calls awsconfig.LoadDefaultConfig (aws-sdk-go-v2) to resolve the AWS credential and region chain. This error is returned when every resolution step in the default chain fails, with the SDK's cause embedded via %v. Without a config the reconciler cannot create its EC2 client.

Source

Thrown at cmd/kops-controller/controllers/awsipam.go:60

)

// NewAWSIPAMReconciler is the constructor for a IPAMReconciler
func NewAWSIPAMReconciler(ctx context.Context, mgr manager.Manager) (*AWSIPAMReconciler, error) {
	klog.Info("Starting aws ipam controller")
	r := &AWSIPAMReconciler{
		client: mgr.GetClient(),
		log:    ctrl.Log.WithName("controllers").WithName("IPAM"),
	}

	coreClient, err := corev1client.NewForConfig(mgr.GetConfig())
	if err != nil {
		return nil, fmt.Errorf("error building corev1 client: %v", err)
	}
	r.coreV1Client = coreClient

	config, err := awsconfig.LoadDefaultConfig(ctx, awslog.WithAWSLogger())
	if err != nil {
		return nil, fmt.Errorf("error loading default AWS config: %v", err)
	}

	metadata := imds.NewFromConfig(config)

	resp, err := metadata.GetRegion(ctx, &imds.GetRegionInput{})
	if err != nil {
		return nil, fmt.Errorf("error querying ec2 metadata service (for region): %v", err)
	}

	ec2Config := config.Copy()
	ec2Config.Region = resp.Region
	r.ec2Client = ec2.NewFromConfig(ec2Config)

	return r, nil
}

// AWSIPAMReconciler observes Node objects, and labels them with the correct labels for the instancegroup
// This used to be done by the kubelet, but is moving to a central controller for greater security in 1.16

View on GitHub (pinned to 4c8573c808)

Solutions

1. Read the %v cause — the SDK names which credential provider(s) failed.
2. For IRSA on EKS, ensure the service account has the eks.amazonaws.com/role-arn annotation and the pod has AWS_WEB_IDENTITY_TOKEN_FILE and AWS_REGION env vars.
3. When running off-cluster, export AWS_ACCESS_KEY_ID/AWS_SECRET_ACCESS_KEY (or AWS_PROFILE) and AWS_REGION.
4. If relying on IMDS, confirm the instance metadata service is reachable (v2 token enabled) and AWS_EC2_METADATA_DISABLED is not set.

Example fix

// before: deployment without AWS config
cmd: ["/kops-controller"]
// after: IRSA on EKS
metadata:
  annotations:
    eks.amazonaws.com/role-arn: arn:aws:iam::123456789012:role/kops-controller
spec:
  containers:
  - env:
    - name: AWS_REGION
      value: us-east-1

if os.Getenv("AWS_REGION") == "" &&
    os.Getenv("AWS_DEFAULT_REGION") == "" &&
    os.Getenv("AWS_WEB_IDENTITY_TOKEN_FILE") == "" &&
    os.Getenv("AWS_ACCESS_KEY_ID") == "" {
    return fmt.Errorf("no AWS region or credential source configured (set AWS_REGION or IRSA env)")
}

rec, err := NewAWSIPAMReconciler(ctx, mgr)
if err != nil {
    var cErr *aws.CredentialsCacheError
    if strings.Contains(err.Error(), "error loading default AWS config") {
        return fmt.Errorf("AWS config chain failed: check credentials/region env or IRSA role: %w", err)
    }
    _ = cErr
    return err
}

When it happens

Trigger: Calling NewAWSIPAMReconciler when LoadDefaultConfig cannot obtain credentials or base config: no AWS_ACCESS_KEY_ID/AWS_SECRET_ACCESS_KEY, no usable shared-config files, no web-identity token file, or an invalid AWS_REGION/AWS_PROFILE / malformed shared config file.

Common situations: Running kops-controller outside AWS without exported credentials; an IRSA service-account annotation pointing to a missing role; a typo'd AWS_PROFILE in ~/.aws/config; malformed shared credentials/config files; SDK v2 requiring AWS_EC2_METADATA_DISABLED=false when IMDS is the only source.

Related errors

• failed to load aws config: %w
• error initializing AWS client: %v
• failed to load default aws config: %w
• failed to load default aws config: %w
• getting AWS credentials: %w

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/d175ebc221191939. Report an issue: GitHub.