{"record":{"id":"1b52817ebb0bcc80","repo":"kubernetes/kops","slug":"deleting-role-assignment-w","errorCode":null,"errorMessage":"deleting role assignment: %w","messagePattern":"deleting role assignment: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"upup/pkg/fi/cloudup/azure/roleassignment.go","lineNumber":69,"sourceCode":"}\n\nfunc (c *roleAssignmentsClientImpl) List(ctx context.Context, scope string) ([]*authz.RoleAssignment, error) {\n\tvar l []*authz.RoleAssignment\n\tpager := c.c.NewListForScopePager(scope, nil)\n\tfor pager.More() {\n\t\tresp, err := pager.NextPage(ctx)\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"listing role assignments: %w\", err)\n\t\t}\n\t\tl = append(l, resp.Value...)\n\t}\n\treturn l, nil\n}\n\nfunc (c *roleAssignmentsClientImpl) Delete(ctx context.Context, scope, raName string) error {\n\t_, err := c.c.Delete(ctx, scope, raName, nil)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"deleting role assignment: %w\", err)\n\t}\n\treturn nil\n}\n\nfunc newRoleAssignmentsClientImpl(subscriptionID string, cred *azidentity.DefaultAzureCredential) (*roleAssignmentsClientImpl, error) {\n\tc, err := authz.NewRoleAssignmentsClient(subscriptionID, cred, nil)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"creating role assignments client: %w\", err)\n\t}\n\treturn &roleAssignmentsClientImpl{\n\t\tc: c,\n\t}, nil\n}\n","sourceCodeStart":51,"sourceCodeEnd":83,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/upup/pkg/fi/cloudup/azure/roleassignment.go#L51-L83","documentation":"Wraps the synchronous failure of authz.RoleAssignmentsClient.Delete, which removes a role assignment at a scope by its role assignment name (a GUID). Failure means ARM rejected the delete request; the wrapped *azcore.ResponseError identifies the exact code.","triggerScenarios":"roleAssignmentsClientImpl.Delete(ctx, scope, raName) failing: assignment already deleted (RoleAssignmentNotFound / does not exist), raName not a valid GUID, RBAC denies Microsoft.Authorization/roleAssignments/delete (requires Owner or User Access Administrator), or scope mismatch.","commonSituations":"Double-delete during cluster teardown (assignment already removed); identity lacking User Access Administrator when cleaning up kOps-created role assignments; scope string drifted from the one used at creation.","solutions":["If the wrapped error is RoleAssignmentNotFound, treat the assignment as already deleted and continue","Ensure the acting identity has Owner or User Access Administrator at the scope (Microsoft.Authorization/roleAssignments/delete)","Verify raName is the role assignment's GUID id segment and scope matches where the assignment was created","Retry after confirming the assignment still exists via List at the same scope"],"exampleFix":null,"handlingStrategy":"type-guard","validationCode":"matched, _ := regexp.MatchString(`^[0-9a-fA-F-]{36}$`, raName)\nif !matched || !validScope(scope) {\n  return errors.New(\"azure: role assignment delete requires a GUID name and valid ARM scope\")\n}","typeGuard":"func isRoleAssignmentNotFound(err error) bool {\n  var re *azcore.ResponseError\n  return errors.As(err, &re) && (re.StatusCode == 404 || re.ErrorCode == \"RoleAssignmentNotFound\")\n}","tryCatchPattern":"err := raClient.Delete(ctx, scope, raName)\nvar re *azcore.ResponseError\nif errors.As(err, &re) && re.StatusCode == 404 {\n  return nil // already deleted; continue teardown\n}\nif err != nil {\n  return fmt.Errorf(\"delete role assignment %s at %s: %w\", raName, scope, err)\n}","preventionTips":["Grant Owner or User Access Administrator for role assignment deletion","Treat 404 as success to make teardown idempotent","Keep scope strings identical between creation and deletion","Look up assignment GUIDs via List at the same scope before deleting"],"tags":["azure","rbac","role-assignments","delete"],"backgroundTag":"azure-resource-delete-failed","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T07:17:12.445Z"}