kubernetes/kops · error

error tagging IAMOIDCProvider: %v

Error message

error tagging IAMOIDCProvider: %v

What it means

Returned by IAMOIDCProvider.RenderAWS when TagOpenIDConnectProvider fails while applying desired tags to the OIDC provider. It pairs with the untag step: kOps diffs existing vs desired tags and applies additions via this call.

Source

Thrown at upup/pkg/fi/cloudup/awstasks/iamoidcprovider.go:176

					existingTagKeys = append(existingTagKeys, k)
				}
				untagRequest := &iam.UntagOpenIDConnectProviderInput{
					OpenIDConnectProviderArn: a.arn,
					TagKeys:                  existingTagKeys,
				}
				_, err := t.Cloud.IAM().UntagOpenIDConnectProvider(ctx, untagRequest)
				if err != nil {
					return fmt.Errorf("error untagging IAMOIDCProvider: %v", err)
				}
			}
			if len(e.Tags) > 0 {
				tagRequest := &iam.TagOpenIDConnectProviderInput{
					OpenIDConnectProviderArn: a.arn,
					Tags:                     mapToIAMTags(e.Tags),
				}
				_, err := t.Cloud.IAM().TagOpenIDConnectProvider(ctx, tagRequest)
				if err != nil {
					return fmt.Errorf("error tagging IAMOIDCProvider: %v", err)
				}
			}
		}
		if changes.ClientIDs != nil {
			actual := sets.NewString()
			for _, aud := range a.ClientIDs {
				actual.Insert(aud)
			}
			expected := sets.NewString()
			for _, aud := range e.ClientIDs {
				expected.Insert(aud)
			}
			toRemove := actual.Difference(expected)
			for _, elem := range toRemove.List() {
				request := &iam.RemoveClientIDFromOpenIDConnectProviderInput{
					OpenIDConnectProviderArn: a.arn,
					ClientID:                 &elem,
				}

View on GitHub (pinned to 4c8573c808)

Solutions

1. Remove reserved 'aws:' prefixed keys or invalid tag values from the cluster spec's tag configuration.
2. Grant iam:TagOpenIDConnectProvider to the kOps principal.
3. Verify the provider still exists and re-run apply.
4. Check tag limits (50 tags/provider, key ≤128 chars, value ≤256 chars).

Example fix

// before: reserved prefix rejected by IAM
Tags: map[string]string{"aws:team": "platform"}
// after: use a custom prefix
Tags: map[string]string{"team": "platform"}

// validate tags against IAM constraints before calling TagOpenIDConnectProvider
for k, v := range tags {
    if strings.HasPrefix(k, "aws:") { return fmt.Errorf("reserved tag key %q", k) }
    if len(k) > 128 || len(v) > 256 { return fmt.Errorf("tag %q exceeds IAM size limits", k) }
}
if len(tags) > 50 { return errors.New("more than 50 tags") }

func isInvalidTag(err error) bool { var ae smithy.APIError; return errors.As(err, &ae) && strings.Contains(ae.ErrorCode(), "Validation") }

When it happens

Trigger: TagOpenIDConnectProvider fails: missing iam:TagOpenIDConnectProvider permission, provider ARN no longer exists, invalid tag values (e.g. exceeding 256 chars or invalid prefix like reserved aws: keys), or throttling.

Common situations: Cluster spec tags including an 'aws:' prefixed key (reserved, rejected by IAM); overly long tag values from templating; policies not updated since tagging support was added.

Related errors

• error untagging IAMOIDCProvider: %v
• error listing oidc providers: %v
• error describing oidc provider: %v
• error creating IAMOIDCProvider: %v
• error updating IAMOIDCProvider Thumbprints: %v

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/084192f3b8ab0b0c. Report an issue: GitHub.