{"record":{"id":"51216437e87f2e9c","repo":"kubernetes/kops","slug":"cannot-delete-the-only-control-plane-instance-grou","errorCode":null,"errorMessage":"cannot delete the only control plane instance group","messagePattern":"cannot delete the only control plane instance group","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"cmd/kops/delete_instancegroup.go","lineNumber":165,"sourceCode":"\n\tfmt.Fprintf(out, \"InstanceGroup %q found for deletion\\n\", groupName)\n\n\tif group.Spec.Role.HasControlPlane() {\n\t\tgroups, err := clientset.InstanceGroupsFor(cluster).List(ctx, metav1.ListOptions{})\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"listing InstanceGroups: %v\", err)\n\t\t}\n\n\t\tonlyMaster := true\n\t\tfor _, ig := range groups.Items {\n\t\t\tif ig.Name != groupName && ig.Spec.Role.HasControlPlane() {\n\t\t\t\tonlyMaster = false\n\t\t\t\tbreak\n\t\t\t}\n\t\t}\n\n\t\tif onlyMaster {\n\t\t\treturn fmt.Errorf(\"cannot delete the only control plane instance group\")\n\t\t}\n\t}\n\n\tif !options.Yes {\n\t\tfmt.Fprintf(out, \"\\nMust specify --yes to delete instancegroup\\n\")\n\t\treturn nil\n\t}\n\n\tcloud, err := cloudup.BuildCloud(cluster)\n\tif err != nil {\n\t\treturn err\n\t}\n\n\td := &instancegroups.DeleteInstanceGroup{}\n\td.Cluster = cluster\n\td.Cloud = cloud\n\td.Clientset = clientset\n","sourceCodeStart":147,"sourceCodeEnd":183,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/cmd/kops/delete_instancegroup.go#L147-L183","documentation":"Safety guard: kOps refuses to delete the only instance group with a control-plane role, since that would leave the cluster without a control plane and unrecoverable. The check runs only when the target group has the control-plane role and no other control-plane group exists.","triggerScenarios":"Running `kops delete instancegroup <name> --yes` where <name> is the sole instance group whose Spec.Role.HasControlPlane() is true.","commonSituations":"Trying to tear down just the masters to rebuild them; cleaning up a single-master cluster by deleting its control-plane group instead of deleting the whole cluster.","solutions":["Create a second control-plane instance group first (kops create instancegroup with role Master), update the cluster, then delete the old one","If you intend to remove the cluster entirely, use `kops delete cluster` instead","Add another master node group via `kops create ig` and `kops update cluster --yes` before deleting"],"exampleFix":"// before\nkops delete instancegroup master-us-east-1a --yes\n// after: add a replacement control-plane IG first\nkops create instancegroup master-us-east-1b --role Master --name mycluster.k8s.local\nkops update cluster --yes\nkops delete instancegroup master-us-east-1a --yes","handlingStrategy":"validation","validationCode":"igs, _ := clientset.InstanceGroupsFor(cluster).List(ctx, metav1.ListOptions{})\ncpCount := 0\nfor _, ig := range igs.Items {\n    if ig.Spec.Role.HasControlPlane() { cpCount++ }\n}\n// proceed with delete only if cpCount > 1 and target is control-plane","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Never delete a control-plane group unless at least one other exists","Use `kops get instancegroups` and check roles before --yes","Prefer `kops delete cluster` when dismantling the whole cluster","Add a replacement Master-role IG and run `kops update cluster --yes` before removing an old one"],"tags":["cli","control-plane","safety-guard"],"backgroundTag":"unsafe-delete-refused","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T07:17:12.445Z"}