{"record":{"id":"2d964c8fc18b0be0","repo":"kubernetes/kops","slug":"error-dialing-tcp-s-w","errorCode":null,"errorMessage":"error dialing tcp %s: %w","messagePattern":"error dialing tcp (.+?): %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/dump/dumper.go","lineNumber":690,"sourceCode":"func (f *sshClientFactoryImplementation) Dial(ctx context.Context, host string, useBastion bool) (sshClient, error) {\n\taddr := host\n\tif useBastion {\n\t\tif f.bastion == \"\" {\n\t\t\treturn nil, fmt.Errorf(\"bastion is not set, but useBastion is true\")\n\t\t}\n\t\taddr = f.bastion\n\t}\n\n\tif addr == \"\" {\n\t\treturn nil, fmt.Errorf(\"host is empty\")\n\t}\n\taddr = net.JoinHostPort(addr, \"22\")\n\td := net.Dialer{\n\t\tTimeout: 5 * time.Second,\n\t}\n\tconn, err := d.DialContext(ctx, \"tcp\", addr)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"error dialing tcp %s: %w\", addr, err)\n\t}\n\n\t// We have a TCP connection; we will force-close it to support context cancellation\n\n\tvar client *ssh.Client\n\tfinished := make(chan error)\n\tgo func() {\n\t\tc, chans, reqs, err := ssh.NewClientConn(conn, addr, f.sshConfig)\n\t\tif err == nil {\n\t\t\tclient = ssh.NewClient(c, chans, reqs)\n\t\t\tif useBastion {\n\t\t\t\terr = agent.ForwardToAgent(client, f.keyRing)\n\t\t\t\tif err != nil {\n\t\t\t\t\terr = fmt.Errorf(\"forwarding ssh auth to keyring: %w\", err)\n\t\t\t\t}\n\t\t\t}\n\t\t}\n","sourceCodeStart":672,"sourceCodeEnd":708,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/pkg/dump/dumper.go#L672-L708","documentation":"Dial wraps the error from net.Dialer.DialContext with this message when the initial TCP connection to host:22 (or bastion:22) fails. The wrapped %w error is the underlying net error (timeout, connection refused, no route to host, DNS failure). The library uses a 5-second dial timeout, so slow/unreachable hosts surface as i/o timeout.","triggerScenarios":"TCP dial to addr (net.JoinHostPort(host, \"22\") or bastion:22) fails: security group blocks port 22, host is down/terminated, DNS name unresolvable, 5s timeout exceeded, or wrong IP recorded for the instance.","commonSituations":"AWS security groups not allowing SSH from the operator's network; dumping a cluster where nodes are in private subnets and neither direct SSH nor the bastion is reachable; bastion instance stopped; stale DNS or IP after node replacement.","solutions":["Check network reachability: open port 22 in the security group / firewall for your source IP, or run the dump from within the VPC","Verify the target host/bastion instance is running and its recorded IP/DNS is current (kops get instances / cloud console)","If a bastion is required, confirm it is up and Dial is being called with useBastion=true and a valid bastion address","Inspect the wrapped error in the message to distinguish timeout vs connection refused vs DNS failure and act accordingly"],"exampleFix":"// before (host unreachable directly)\nclient, err := factory.Dial(ctx, privateNodeIP, false)\n\n// after (route via bastion)\nclient, err := factory.Dial(ctx, privateNodeIP, factory.HasBastion())","handlingStrategy":"retry","validationCode":"conn, err := net.DialTimeout(\"tcp\", net.JoinHostPort(host, \"22\"), 3*time.Second)\nif err != nil {\n\treturn fmt.Errorf(\"host %s unreachable on tcp/22 before dump: %w\", host, err)\n}\nconn.Close()","typeGuard":"func isDialError(err error) bool { return strings.Contains(err.Error(), \"error dialing tcp\") }","tryCatchPattern":"client, err := factory.Dial(ctx, host, useBastion)\nif err != nil {\n\tvar netErr net.Error\n\tif strings.Contains(err.Error(), \"error dialing tcp\") && errors.As(err, &netErr) {\n\t\treturn fmt.Errorf(\"check security groups allow tcp/22 to %s: %w\", host, err)\n\t}\n\treturn err\n}","preventionTips":["Pre-flight check tcp/22 reachability before running dumps","Ensure security groups/firewalls permit SSH from your network or run inside the VPC","Use the bastion path for private-subnet nodes","Increase context timeout for slow links"],"tags":["network","ssh","tcp","timeout"],"backgroundTag":"connection-refused","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T07:17:12.445Z"}