{"record":{"id":"3af1043feca18b5b","repo":"kubernetes/kops","slug":"error-deleting-cloud-resources-for-instancegroup","errorCode":null,"errorMessage":"error deleting cloud resources for InstanceGroup: %v","messagePattern":"error deleting cloud resources for InstanceGroup: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/instancegroups/delete.go","lineNumber":58,"sourceCode":"\n\tgroups, err := d.Cloud.GetCloudGroups(d.Cluster, []*api.InstanceGroup{group}, false, nil)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"error finding CloudInstanceGroups: %v\", err)\n\t}\n\n\tfor _, g := range groups {\n\t\tif g.InstanceGroup == nil || g.InstanceGroup.Name != group.Name {\n\t\t\treturn fmt.Errorf(\"found group with unexpected name: %v\", g)\n\t\t}\n\t}\n\n\t// TODO should we drain nodes and validate the cluster?\n\tfor _, g := range groups {\n\t\tklog.Infof(\"Deleting %q\", group.ObjectMeta.Name)\n\n\t\terr = d.Cloud.DeleteGroup(g)\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"error deleting cloud resources for InstanceGroup: %v\", err)\n\t\t}\n\t}\n\n\terr = d.Clientset.InstanceGroupsFor(d.Cluster).Delete(ctx, group.ObjectMeta.Name, metav1.DeleteOptions{})\n\tif err != nil {\n\t\treturn err\n\t}\n\n\treturn nil\n}\n","sourceCodeStart":40,"sourceCodeEnd":69,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/pkg/instancegroups/delete.go#L40-L69","documentation":"For each validated cloud group, DeleteInstanceGroup calls Cloud.DeleteGroup. If the provider's delete call fails (permissions, dependency instances, API errors), the error is wrapped with this prefix. The k8s InstanceGroup object is intentionally left untouched since cloud teardown failed.","triggerScenarios":"Cloud.DeleteGroup returns an error, e.g. IAM role lacks autoscaling:DeleteAutoScalingGroup, the ASG still has instances/attachments, or a transient cloud API failure during `kops delete ig`.","commonSituations":"Deleting an ASG with instances that have termination protection, insufficient cloud credentials, or region misconfiguration.","solutions":["Inspect the wrapped provider error and resolve it (fix IAM permissions, disable termination protection, drain instances)","Verify credentials and region of the fi.Cloud client","Retry the delete once the underlying cloud condition is fixed"],"exampleFix":null,"handlingStrategy":"retry","validationCode":"// Verify IAM permissions before attempting deletion, e.g. for AWS:\n_, err := asgClient.DeleteAutoScalingGroup(&autoscaling.DeleteAutoScalingGroupInput{\n\tAutoScalingGroupName: aws.String(asgName),\n\tForceDelete:          aws.Bool(false),\n})\n_ = err // surface authorization failures early","typeGuard":null,"tryCatchPattern":"err := d.DeleteInstanceGroup(group)\nif err != nil && strings.Contains(err.Error(), \"error deleting cloud resources\") {\n\tif isTransient(err) {\n\t\ttime.Sleep(30 * time.Second)\n\t\terr = d.DeleteInstanceGroup(group)\n\t}\n}","preventionTips":["Grant the kops IAM role delete permissions for autoscaling groups/instance groups","Disable termination protection and drain dependent instances before deleting","Check the cloud console for blocking resources (attachments, lifecycle hooks) before deleting"],"tags":["cloud-api","instancegroups","delete","permissions"],"backgroundTag":"cloud-resource-deletion-failed","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T07:17:12.445Z"}