kubernetes/kops · error

error updating IAMOIDCProvider Thumbprints: %v

Error message

error updating IAMOIDCProvider Thumbprints: %v

What it means

Returned by IAMOIDCProvider.RenderAWS when UpdateOpenIDConnectProviderThumbprint fails while kOps refreshes the thumbprint list of an existing OIDC provider. kOps recalculates thumbprints (e.g. when the discovery host certificate changes) and pushes them via this API.

Source

Thrown at upup/pkg/fi/cloudup/awstasks/iamoidcprovider.go:151

		}

		response, err := t.Cloud.IAM().CreateOpenIDConnectProvider(ctx, request)
		if err != nil {
			return fmt.Errorf("error creating IAMOIDCProvider: %v", err)
		}

		e.arn = response.OpenIDConnectProviderArn
	} else {
		if changes.Thumbprints != nil {
			klog.V(2).Infof("Updating IAMOIDCProvider Thumbprints %q", fi.ValueOf(e.arn))

			request := &iam.UpdateOpenIDConnectProviderThumbprintInput{}
			request.OpenIDConnectProviderArn = a.arn
			request.ThumbprintList = thumbprints

			_, err := t.Cloud.IAM().UpdateOpenIDConnectProviderThumbprint(ctx, request)
			if err != nil {
				return fmt.Errorf("error updating IAMOIDCProvider Thumbprints: %v", err)
			}
		}
		if changes.Tags != nil {
			if len(a.Tags) > 0 {
				existingTagKeys := make([]string, 0)
				for k := range a.Tags {
					existingTagKeys = append(existingTagKeys, k)
				}
				untagRequest := &iam.UntagOpenIDConnectProviderInput{
					OpenIDConnectProviderArn: a.arn,
					TagKeys:                  existingTagKeys,
				}
				_, err := t.Cloud.IAM().UntagOpenIDConnectProvider(ctx, untagRequest)
				if err != nil {
					return fmt.Errorf("error untagging IAMOIDCProvider: %v", err)
				}
			}
			if len(e.Tags) > 0 {

View on GitHub (pinned to 4c8573c808)

Solutions

1. Add iam:UpdateOpenIDConnectProviderThumbprint to the kOps IAM policy.
2. Confirm the provider ARN still exists in IAM; recreate via re-running kops apply if deleted.
3. Retry after transient throttling/network errors.
4. Verify the discovery endpoint TLS certificate is valid and reachable, since kOps fetches it to compute thumbprints.

// verify the provider ARN still exists and endpoint TLS is valid before updating thumbprints
d, err := iamClient.GetOpenIDConnectProviderWithContext(ctx, &iam.GetOpenIDConnectProviderInput{OpenIDConnectProviderArn: arn})
if err != nil { return err } // recreate provider first
resp, err := http.Get(discoveryURL) // ensure TLS fetch succeeds so thumbprints are current

func isThrottling(err error) bool { var ae smithy.APIError; return errors.As(err, &ae) && (ae.ErrorCode() == "ThrottlingException" || ae.ErrorCode() == "TooManyRequestsException") }

_, err := iamClient.UpdateOpenIDConnectProviderThumbprintWithContext(ctx, req)
if err != nil {
    if isThrottling(err) { return retryWithBackoff(ctx, op) }
    return fmt.Errorf("error updating IAMOIDCProvider Thumbprints: %w", err)
}

When it happens

Trigger: UpdateOpenIDConnectProviderThumbprint fails: missing iam:UpdateOpenIDConnectProviderThumbprint permission, provider ARN not found (deleted concurrently), or throttling.

Common situations: OIDC discovery endpoint certificate rotated, triggering a thumbprint update on an account whose policy predates thumbprint-update support; provider removed by another tool between Find and Render; regional endpoints changes.

Related errors

• error listing oidc providers: %v
• error describing oidc provider: %v
• error creating IAMOIDCProvider: %v
• error untagging IAMOIDCProvider: %v
• error tagging IAMOIDCProvider: %v

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/53ecb6acfab4d7b6. Report an issue: GitHub.