kubernetes/kops · error

error removing audience %s to IAMOIDCProvider: %v

Error message

error removing audience %s to IAMOIDCProvider: %v

What it means

Returned by IAMOIDCProvider.RenderAWS when RemoveClientIDFromOpenIDConnectProvider fails while pruning an audience (client ID) that is no longer desired on the OIDC provider. kOps diffs expected vs actual client IDs and removes the extras with this call. Note the message text says 'removing audience %s to' (a typo for 'from').

Source

Thrown at upup/pkg/fi/cloudup/awstasks/iamoidcprovider.go:197

		}
		if changes.ClientIDs != nil {
			actual := sets.NewString()
			for _, aud := range a.ClientIDs {
				actual.Insert(aud)
			}
			expected := sets.NewString()
			for _, aud := range e.ClientIDs {
				expected.Insert(aud)
			}
			toRemove := actual.Difference(expected)
			for _, elem := range toRemove.List() {
				request := &iam.RemoveClientIDFromOpenIDConnectProviderInput{
					OpenIDConnectProviderArn: a.arn,
					ClientID:                 &elem,
				}
				_, err := t.Cloud.IAM().RemoveClientIDFromOpenIDConnectProvider(ctx, request)
				if err != nil {
					return fmt.Errorf("error removing audience %s to IAMOIDCProvider: %v", elem, err)
				}
			}
			toAdd := expected.Difference(actual)
			for _, elem := range toAdd.List() {
				request := &iam.AddClientIDToOpenIDConnectProviderInput{
					OpenIDConnectProviderArn: a.arn,
					ClientID:                 &elem,
				}
				_, err := t.Cloud.IAM().AddClientIDToOpenIDConnectProvider(ctx, request)
				if err != nil {
					return fmt.Errorf("error adding audience %s to IAMOIDCProvider: %v", elem, err)
				}
			}
		}
	}
	return nil
}

View on GitHub (pinned to 4c8573c808)

Solutions

1. Add iam:RemoveClientIDFromOpenIDConnectProvider and iam:AddClientIDToOpenIDConnectProvider to the kOps policy.
2. Re-run kops apply — if the audience was already removed, the next pass reconciles cleanly.
3. Check for other automation managing client IDs on the same provider ARN and single-source ownership.
4. Verify provider existence; recreate via apply if it was deleted.

// pre-read actual client IDs and only remove ones truly present
out, err := iamClient.GetOpenIDConnectProviderWithContext(ctx, &iam.GetOpenIDConnectProviderInput{OpenIDConnectProviderArn: arn})
if err != nil { return err }
present := sets.NewString(aws.StringValueSlice(out.ClientIDList)...)
toRemove := actual.Intersect(present) // skip already-removed audiences

func isNoSuchEntity(err error) bool { var ae smithy.APIError; return errors.As(err, &ae) && ae.ErrorCode() == "NoSuchEntityException" }

_, err := iamClient.RemoveClientIDFromOpenIDConnectProviderWithContext(ctx, req)
if err != nil {
    if isNoSuchEntity(err) { continue } // already removed; reconcile next pass
    return fmt.Errorf("error removing audience %s from IAMOIDCProvider: %w", elem, err)
}

When it happens

Trigger: RemoveClientIDFromOpenIDConnectProvider fails: missing iam:RemoveClientIDFromOpenIDConnectProvider permission, provider deleted concurrently, or the client ID was already removed by another actor (NoSuchEntity).

Common situations: Changing the cluster's service-account issuer audience configuration while another tool (e.g. eksctl) manages the same provider; IAM policies written before client-ID APIs were adopted; concurrent kops applies.

Related errors

• error listing oidc providers: %v
• error describing oidc provider: %v
• error creating IAMOIDCProvider: %v
• error updating IAMOIDCProvider Thumbprints: %v
• error untagging IAMOIDCProvider: %v

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/1da075834c172b64. Report an issue: GitHub.