kubernetes/kops · error

unsupported cloud provider for authenticator %q

Error message

unsupported cloud provider for authenticator %q

What it means

nodeup builds a kops-controller bootstrap authenticator per cloud provider (AWS, GCE, OpenStack, DO, Scaleway, Azure, Linode, Metal). When the cluster's configured cloudProvider does not match any supported case in this switch, the builder aborts with this error. It almost always means the cluster spec carries a cloud provider value that nodeup does not recognize for node bootstrapping.

Source

Thrown at nodeup/pkg/model/bootstrap_client.go:112

			return err
		}
		authenticator = a
	case kops.CloudProviderLinode:
		a, err := linodemetadata.NewLinodeAuthenticator()
		if err != nil {
			return err
		}
		authenticator = a

	case kops.CloudProviderMetal:
		a, err := pkibootstrap.NewAuthenticatorFromFile("/etc/kubernetes/kops/pki/machine/private.pem")
		if err != nil {
			return err
		}
		authenticator = a

	default:
		return fmt.Errorf("unsupported cloud provider for authenticator %q", b.CloudProvider())
	}

	baseURL := url.URL{
		Scheme: "https",
		Host:   net.JoinHostPort("kops-controller.internal."+b.NodeupConfig.ClusterName, strconv.Itoa(wellknownports.KopsControllerPort)),
		Path:   "/",
	}

	bootstrapClient := kopscontrollerclient.New(authenticator, []byte(b.NodeupConfig.CAs[fi.CertificateIDCA]), baseURL)
	bootstrapClientTask := &nodetasks.BootstrapClientTask{
		Client:     bootstrapClient,
		Certs:      b.bootstrapCerts,
		KeypairIDs: b.bootstrapKeypairIDs,
	}
	bootstrapClientTask.UseChallengeCallback = b.UseChallengeCallback(b.CloudProvider())
	bootstrapClientTask.ClusterName = b.NodeupConfig.ClusterName

	for _, cert := range b.bootstrapCerts {

View on GitHub (pinned to 4c8573c808)

Solutions

1. Check the cluster spec's spec.cloudProvider value in the state store and correct any typo or casing (must be e.g. aws, gce, openstack, digitalocean, scaleway, azure, linode, metal).
2. If using a recently added provider, upgrade nodeup on the node to a kops version that supports that provider's authenticator.
3. Regenerate the NodeupConfig via 'kops update cluster' so the config is consistent with the cluster spec.
4. If you maintain a fork adding a provider, add the corresponding case to the switch in nodeup/pkg/model/bootstrap_client.go.

Example fix

# before (cluster.yaml)
cloudProvider: Aws
# after
cloudProvider: aws

provider := cluster.Spec.CloudProvider
switch provider {
case "aws", "gce", "openstack", "digitalocean", "scaleway", "azure", "linode", "metal":
	// ok
default:
	return fmt.Errorf("cloudProvider %q not supported for bootstrap; fix cluster.yaml before running nodeup", provider)
}

When it happens

Trigger: nodeup runs Build() with b.CloudProvider() returning a value not in the switch (typo, empty string, unsupported/legacy provider, or wrong enum constant in the NodeupConfig/cluster spec).

Common situations: Hand-edited cluster.yaml with an invalid cloudProvider (e.g. lowercase 'aws', 'baremetal', empty); running nodeup built from a version where the provider was added to the cluster spec but not to this authenticator switch; using a custom kops fork that adds a provider without updating bootstrap_client.go.

Understand the failure class

• Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

Related errors

• ConfigBase or ConfigServer is required
• building nodeConfig for instanceGroup: %w
• parsing path for kops-channels manifest %s: %w
• no keypairID for %q
• cannot parse ConfigBase %q: %v

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/95073ed89d37f30b. Report an issue: GitHub.