{"record":{"id":"28ef5e038510ac3e","repo":"kubernetes/kops","slug":"reading-instance-groups-w","errorCode":null,"errorMessage":"reading instance groups: %w","messagePattern":"reading instance groups: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/commands/toolbox_enroll.go","lineNumber":639,"sourceCode":"\nfunc (b *ConfigBuilder) GetInstanceGroups(ctx context.Context) (*kops.InstanceGroupList, error) {\n\tif b.instanceGroups != nil {\n\t\treturn b.instanceGroups, nil\n\t}\n\n\tcluster, err := b.GetCluster(ctx)\n\tif err != nil {\n\t\treturn nil, err\n\t}\n\n\tclientset, err := b.GetClientset(ctx)\n\tif err != nil {\n\t\treturn nil, err\n\t}\n\n\tinstanceGroupList, err := clientset.InstanceGroupsFor(cluster).List(ctx, metav1.ListOptions{})\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"reading instance groups: %w\", err)\n\t}\n\n\tb.instanceGroups = instanceGroupList\n\treturn instanceGroupList, nil\n}\n\nfunc (b *ConfigBuilder) GetCluster(ctx context.Context) (*kops.Cluster, error) {\n\tif b.Cluster != nil {\n\t\treturn b.Cluster, nil\n\t}\n\n\tif b.ClusterName == \"\" {\n\t\treturn nil, fmt.Errorf(\"ClusterName is missing\")\n\t}\n\n\tclientset, err := b.GetClientset(ctx)\n\tif err != nil {\n\t\treturn nil, err","sourceCodeStart":621,"sourceCodeEnd":657,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/pkg/commands/toolbox_enroll.go#L621-L657","documentation":"GetInstanceGroups lists instance groups via the Kubernetes-style clientset (InstanceGroupsFor(cluster).List) and wraps any API failure. This is a state-store/backend read failure, not a spec validation problem.","triggerScenarios":"clientset.InstanceGroupsFor(cluster).List returns an error: state store unreachable/permission denied, backend (S3/GCS/etcd-backed API) outage, or malformed cluster object preventing path resolution.","commonSituations":"Wrong/missing --state store credentials (S3 bucket policy, GCS IAM); offline or VPN-blocked access to the state store; corrupted state store entry for the cluster.","solutions":["Verify state store access: `kops get clusters --state <store>` with the same credentials","Check cloud IAM/bucket permissions for the state store path","Retry on transient network errors to the backend","Inspect the wrapped root error for 403 vs timeout vs not-found specifics"],"exampleFix":"// before\nigs, err := b.GetInstanceGroups(ctx)\n// after\nif err != nil {\n    return fmt.Errorf(\"check --state store access and credentials: %w\", err)\n}","handlingStrategy":"retry","validationCode":"// reachability pre-check against the state store\nif err := kopsutil.ValidateStateStore(ctx, stateStore); err != nil { return err }","typeGuard":"func isIGListError(err error) bool {\n    return err != nil && strings.Contains(err.Error(), \"reading instance groups\")\n}","tryCatchPattern":"igs, err := b.GetInstanceGroups(ctx)\nif isIGListError(err) {\n    if isTransient(err) { return retryWithBackoff(ctx, b.GetInstanceGroups) }\n    return fmt.Errorf(\"check state store credentials/access: %w\", err)\n}","preventionTips":["Verify cloud IAM/bucket permissions for the state store","Confirm network access to the state store backend","Back up and validate the state store regularly"],"tags":["state-store","kubernetes","api"],"backgroundTag":"state-store-read-failed","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T07:17:12.445Z"}