kubernetes/kops · error

error untagging IAMOIDCProvider: %v

Error message

error untagging IAMOIDCProvider: %v

What it means

Returned by IAMOIDCProvider.RenderAWS when UntagOpenIDConnectProvider fails while removing stale tags from the OIDC provider during a tag diff. kOps first untags removed keys, then applies new tags; this wrapper signals the untag half failed.

Source

Thrown at upup/pkg/fi/cloudup/awstasks/iamoidcprovider.go:166

			_, err := t.Cloud.IAM().UpdateOpenIDConnectProviderThumbprint(ctx, request)
			if err != nil {
				return fmt.Errorf("error updating IAMOIDCProvider Thumbprints: %v", err)
			}
		}
		if changes.Tags != nil {
			if len(a.Tags) > 0 {
				existingTagKeys := make([]string, 0)
				for k := range a.Tags {
					existingTagKeys = append(existingTagKeys, k)
				}
				untagRequest := &iam.UntagOpenIDConnectProviderInput{
					OpenIDConnectProviderArn: a.arn,
					TagKeys:                  existingTagKeys,
				}
				_, err := t.Cloud.IAM().UntagOpenIDConnectProvider(ctx, untagRequest)
				if err != nil {
					return fmt.Errorf("error untagging IAMOIDCProvider: %v", err)
				}
			}
			if len(e.Tags) > 0 {
				tagRequest := &iam.TagOpenIDConnectProviderInput{
					OpenIDConnectProviderArn: a.arn,
					Tags:                     mapToIAMTags(e.Tags),
				}
				_, err := t.Cloud.IAM().TagOpenIDConnectProvider(ctx, tagRequest)
				if err != nil {
					return fmt.Errorf("error tagging IAMOIDCProvider: %v", err)
				}
			}
		}
		if changes.ClientIDs != nil {
			actual := sets.NewString()
			for _, aud := range a.ClientIDs {
				actual.Insert(aud)
			}

View on GitHub (pinned to 4c8573c808)

Solutions

1. Add iam:UntagOpenIDConnectProvider (and iam:TagOpenIDConnectProvider, iam:ListOpenIDConnectProviderTags) to the kOps policy.
2. Re-run kops apply after transient failures.
3. Ensure no other automation concurrently mutates tags on the same provider.
4. Check tag key constraints (valid characters, length) before removing.

// pre-check current tags so the untag set only contains keys actually present
tagsOut, err := iamClient.ListOpenIDConnectProviderTagsWithContext(ctx, &iam.ListOpenIDConnectProviderTagsInput{OpenIDConnectProviderArn: arn})
if err != nil { return err }

func isAccessDenied(err error) bool { var ae smithy.APIError; return errors.As(err, &ae) && ae.ErrorCode() == "AccessDeniedException" }

_, err := iamClient.UntagOpenIDConnectProviderWithContext(ctx, untagReq)
if err != nil {
    if isAccessDenied(err) { return fmt.Errorf("missing iam:UntagOpenIDConnectProvider: %w", err) }
    return fmt.Errorf("error untagging IAMOIDCProvider: %w", err)
}

When it happens

Trigger: UntagOpenIDConnectProvider fails: missing iam:UntagOpenIDConnectProvider permission, provider deleted concurrently, or throttling.

Common situations: Tightened IAM policies missing the relatively new untag permission; tag hygiene automation (e.g. tag policies) conflicting with kOps-managed tags; concurrent applies.

Related errors

• error tagging IAMOIDCProvider: %v
• error listing oidc providers: %v
• error describing oidc provider: %v
• error creating IAMOIDCProvider: %v
• error updating IAMOIDCProvider Thumbprints: %v

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/aff10ed85f0af206. Report an issue: GitHub.