kubernetes/kops · error

missing %s in section of %s

Error message

missing %s in section of %s

What it means

OpenstackConfig.getCredentialFromFile builds gophercloud.AuthOptions from the values read out of the config section. It requires 'identity' and 'password' to be present; if either key is empty in the section, it returns 'missing %s in section of %s' naming the key and section.

Source

Thrown at util/pkg/vfs/swiftfs.go:193

	values, err := oc.getSection("Global", items)
	if err != nil {
		return "", fmt.Errorf("region not provided in OS_REGION_NAME or openstack config section GLOBAL")
	}
	return values["region"], nil
}

func (oc OpenstackConfig) getCredentialFromFile() (gophercloud.AuthOptions, error) {
	opt := gophercloud.AuthOptions{}
	name := "Default"
	items := []string{"identity", "user", "user_id", "password", "domain_id", "domain_name", "tenant_id", "tenant_name"}
	values, err := oc.getSection(name, items)
	if err != nil {
		return opt, err
	}

	for _, c1 := range []string{"identity", "password"} {
		if values[c1] == "" {
			return opt, fmt.Errorf("missing %s in section of %s", c1, name)
		}
	}

	checkItems := [][]string{{"user", "user_id"}, {"domain_name", "domain_id"}, {"tenant_name", "tenant_id"}}
	for _, c2 := range checkItems {
		if values[c2[0]] == "" && values[c2[1]] == "" {
			return opt, fmt.Errorf("missing %s and %s in section of %s", c2[0], c2[1], name)
		}
	}

	opt.IdentityEndpoint = values["identity"]
	opt.UserID = values["user_id"]
	opt.Username = values["user"]
	opt.Password = values["password"]
	opt.TenantID = values["tenant_id"]
	opt.TenantName = values["tenant_name"]
	opt.DomainID = values["domain_id"]
	opt.DomainName = values["domain_name"]

View on GitHub (pinned to 4c8573c808)

Solutions

1. Add identity = <keystone-url> and password = <password> to the relevant section of the openstack config file.
2. Check for typos in the key names (exact keys: identity, password).
3. Alternatively set the OS_* equivalents if the code path supports env-based credentials.
4. Ensure the values are non-empty — a present but blank key still triggers the error.

Example fix

// before
[Global]
identity = https://keystone.example.com:5000/v3
// after
[Global]
identity = https://keystone.example.com:5000/v3
password = s3cret

// Verify required credential keys before calling GetCredential
cfg, _ := ini.Load(configPath)
sec, err := cfg.GetSection("Global")
if err != nil { return err }
for _, key := range []string{"identity", "password"} {
	if sec.Key(key).String() == "" {
		return fmt.Errorf("key %q missing or empty in [%s]", key, "Global")
	}
}

When it happens

Trigger: GetCredential -> getCredentialFromFile when the resolved INI section lacks a non-empty 'identity' (auth URL) or 'password' value.

Common situations: Config file with username/domain set but password omitted (token-based setups), keys misspelled (e.g. 'passwor'), or password left blank because a prompt-based tool was expected to fill it.

Related errors

• error loading config file: %v
• error getting section of %s: %v
• error loading AWS config: %v
• error building openstack authenticated client: %v
• did not find floatingsubnet for external router

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/0e9a7b563fb2b4b5. Report an issue: GitHub.