{"record":{"id":"48b45bd6788cfcf2","repo":"kubernetes/kops","slug":"listing-role-assignments-w","errorCode":null,"errorMessage":"listing role assignments: %w","messagePattern":"listing role assignments: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"upup/pkg/fi/cloudup/azure/roleassignment.go","lineNumber":59,"sourceCode":"\tctx context.Context,\n\tscope string,\n\troleAssignmentName string,\n\tparameters authz.RoleAssignmentCreateParameters,\n) (*authz.RoleAssignment, error) {\n\tresp, err := c.c.Create(ctx, scope, roleAssignmentName, parameters, nil)\n\tif err != nil {\n\t\treturn nil, err\n\t}\n\treturn &resp.RoleAssignment, nil\n}\n\nfunc (c *roleAssignmentsClientImpl) List(ctx context.Context, scope string) ([]*authz.RoleAssignment, error) {\n\tvar l []*authz.RoleAssignment\n\tpager := c.c.NewListForScopePager(scope, nil)\n\tfor pager.More() {\n\t\tresp, err := pager.NextPage(ctx)\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"listing role assignments: %w\", err)\n\t\t}\n\t\tl = append(l, resp.Value...)\n\t}\n\treturn l, nil\n}\n\nfunc (c *roleAssignmentsClientImpl) Delete(ctx context.Context, scope, raName string) error {\n\t_, err := c.c.Delete(ctx, scope, raName, nil)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"deleting role assignment: %w\", err)\n\t}\n\treturn nil\n}\n\nfunc newRoleAssignmentsClientImpl(subscriptionID string, cred *azidentity.DefaultAzureCredential) (*roleAssignmentsClientImpl, error) {\n\tc, err := authz.NewRoleAssignmentsClient(subscriptionID, cred, nil)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"creating role assignments client: %w\", err)","sourceCodeStart":41,"sourceCodeEnd":77,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/upup/pkg/fi/cloudup/azure/roleassignment.go#L41-L77","documentation":"Wraps pager errors while enumerating role assignments at a given scope via authz.RoleAssignmentsClient.NewListForScopePager. Any NextPage failure — authorization, network, throttling, invalid scope — is wrapped here when listing role assignments during cluster teardown/reconciliation.","triggerScenarios":"roleAssignmentsClientImpl.List(ctx, scope) with a malformed scope string (not a valid ARM scope path), or NextPage failing due to RBAC (identity lacks Microsoft.Authorization/roleAssignments/read), throttling, or connectivity.","commonSituations":"Scope built from a wrong resource group name or empty field producing an invalid ARM path; identity with Contributor but no read on role assignments (requires Owner/Reader+ at the scope); ARM 429 on large subscriptions.","solutions":["Verify the scope string is a fully-qualified ARM path like /subscriptions/<id>/resourceGroups/<rg>","Grant the identity Microsoft.Authorization/roleAssignments/read at the scope","Check the wrapped *azcore.ResponseError code and retry with backoff for 429/503","Confirm the scope's resource group/subscription still exists before listing"],"exampleFix":null,"handlingStrategy":"validation","validationCode":"scope := fmt.Sprintf(\"/subscriptions/%s/resourceGroups/%s\", subID, rgName)\nif !strings.HasPrefix(scope, \"/subscriptions/\") || strings.Contains(scope, \"//\") {\n  return errors.New(\"azure: invalid role assignment scope path\")\n}","typeGuard":"func validScope(s string) bool {\n  return regexp.MustCompile(`^/subscriptions/[^/]+(/resourceGroups/[^/]+)?(/providers/[^/]+.*)?$`).MatchString(s)\n}","tryCatchPattern":"ras, err := raClient.List(ctx, scope)\nvar re *azcore.ResponseError\nif errors.As(err, &re) && re.StatusCode == 403 {\n  return nil, fmt.Errorf(\"needs Microsoft.Authorization/roleAssignments/read at %s: %w\", scope, err)\n}","preventionTips":["Build scopes from a single helper to avoid malformed paths","Grant the identity role assignment read (Owner/UAA or Reader at scope)","Back off and retry on ARM 429 when subscriptions have many assignments","Verify the scoped resource exists before listing assignments"],"tags":["azure","rbac","role-assignments","pagination"],"backgroundTag":"azure-sdk-request-failed","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T07:17:12.445Z"}