{"record":{"id":"5ea5c2c8eff8bd70","repo":"kubernetes/kops","slug":"error-finding-deletions-w","errorCode":null,"errorMessage":"error finding deletions: %w","messagePattern":"error finding deletions: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"upup/pkg/fi/cloudup/apply_cluster.go","lineNumber":843,"sourceCode":"\t\t\tout = io.Discard\n\t\t\t// For `kops get assets`,there is no need to run Find,\n\t\t\t// we are just trying to discover the assets.\n\t\t\tcheckExisting = false\n\t\t}\n\t\ttarget = fi.NewCloudupDryRunTarget(assetBuilder, checkExisting, out)\n\n\t\t// Avoid making changes on a dry-run\n\t\tshouldPrecreateDNS = false\n\n\tdefault:\n\t\treturn nil, fmt.Errorf(\"unsupported target type %q\", c.TargetName)\n\t}\n\tc.Target = target\n\n\tif target.DefaultCheckExisting() {\n\t\tc.TaskMap, err = l.FindDeletions(cloud, c.LifecycleOverrides)\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"error finding deletions: %w\", err)\n\t\t}\n\t}\n\n\tcontext, err := fi.NewCloudupContext(ctx, deletionProcessingMode, target, cluster, cloud, keyStore, secretStore, configBase, c.TaskMap)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"error building context: %v\", err)\n\t}\n\n\tvar options fi.RunTasksOptions\n\tif c.RunTasksOptions != nil {\n\t\toptions = *c.RunTasksOptions\n\t} else {\n\t\toptions.InitDefaults()\n\t}\n\n\terr = context.RunTasks(options)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"error running tasks: %v\", err)","sourceCodeStart":825,"sourceCodeEnd":861,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/upup/pkg/fi/cloudup/apply_cluster.go#L825-L861","documentation":"After choosing a target, Run calls l.FindDeletions to discover resources that exist in the cloud but are no longer part of the cluster spec. If that discovery fails (typically an API error listing cloud resources), kops wraps the underlying error and aborts the apply so deletions are never silently skipped.","triggerScenarios":"Any apply whose target returns DefaultCheckExisting()==true (direct and dryrun targets) where FindDeletions errors — e.g. cloud API throttling, permission failures listing resources, or a task's FindDeletions implementation returning an error.","commonSituations":"Cloud credentials lack list/describe permissions on some resource types; regional API outage or rate limiting; an unsupported or misconfigured resource in an existing cluster triggering an error inside a task's deletion discovery.","solutions":["Read the wrapped cause (%w) for the real cloud API error and fix that first — usually IAM/permissions or throttling","Retry after transient cloud API errors (rate limits, 5xx)","Compare the cluster spec against actual cloud state; remove references to resources that no longer exist","Use --target=terraform (deletions are handled by Terraform itself, DeletionProcessingModeIgnore) to bypass FindDeletions","Verify cloud credentials with e.g. `aws sts get-caller-identity` / equivalent for your provider"],"exampleFix":"// before: apply with a principal missing ec2:DescribeVpcs\nkops update cluster mycluster.example.com\n// after: grant list/describe permissions to the kops principal, then\nkops update cluster mycluster.example.com","handlingStrategy":"retry","validationCode":"// preflight: verify credentials can list cloud resources\nif err := cloud.ListAllResources(ctx); err != nil {\n\treturn fmt.Errorf(\"FindDeletions would fail: %w\", err)\n}","typeGuard":null,"tryCatchPattern":"err := cmd.Run(ctx)\nif err != nil && strings.Contains(err.Error(), \"error finding deletions\") {\n\t// inspect wrapped cause: throttle (429), permission denied, or outage\n\t// back off and retry for transient codes\n}","preventionTips":["Grant the kops principal list/describe permissions on all resource types it manages","Handle rate limits with backoff in CI wrappers","Keep cluster spec and cloud state in sync; prune manual resources","Use --target=terraform if Terraform should own deletions"],"tags":["cloud-api","iam","lifecycle"],"backgroundTag":"cloud-api-permission-denied","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T07:17:12.445Z"}