{"record":{"id":"6931d127ea3518ef","repo":"kubernetes/kops","slug":"error-getting-ingress-status-v-6931d1","errorCode":null,"errorMessage":"error getting ingress status: %v","messagePattern":"error getting ingress status: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/controllers/clusterapi/cluster_controller.go","lineNumber":185,"sourceCode":"\nfunc (s *clusterScope) findSystemEndpoints(ctx context.Context) ([]capikops.SystemEndpoint, error) {\n\tcluster := s.Cluster\n\n\tclusterInternal := &kops.Cluster{}\n\tif err := kopscodecs.Scheme.Convert(cluster, clusterInternal, nil); err != nil {\n\t\treturn nil, fmt.Errorf(\"converting cluster object: %w\", err)\n\t}\n\n\tcloud, err := cloudup.BuildCloud(clusterInternal)\n\tif err != nil {\n\t\treturn nil, err\n\t}\n\n\t// TODO: Sync with BuildKubecfg\n\n\tingresses, err := cloud.GetApiIngressStatus(clusterInternal)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"error getting ingress status: %v\", err)\n\t}\n\n\tvar targets []capikops.SystemEndpoint\n\n\tfor _, ingress := range ingresses {\n\t\tvar target capikops.SystemEndpoint\n\t\tif ingress.Hostname != \"\" {\n\t\t\ttarget.Endpoint = ingress.Hostname\n\t\t}\n\t\tif ingress.IP != \"\" {\n\t\t\ttarget.Endpoint = ingress.IP\n\t\t}\n\t\ttarget.Type = capikops.SystemEndpointTypeKopsController\n\t\tif ingress.InternalEndpoint {\n\t\t\ttarget.Scope = capikops.SystemEndpointScopeInternal\n\t\t} else {\n\t\t\ttarget.Scope = capikops.SystemEndpointScopeExternal\n\t\t}","sourceCodeStart":167,"sourceCodeEnd":203,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/pkg/controllers/clusterapi/cluster_controller.go#L167-L203","documentation":"findSystemEndpoints queries the cloud provider (via cloudup.BuildCloud + cloud.GetApiIngressStatus) for the load-balancer ingress addresses that expose kops-controller and the kube-apiserver. This error wraps any failure returned by the cloud lookup itself, meaning kops could not ask the cloud API (or the cloud replied with an error) about the API ingress status. It aborts building the KopsControlPlane status, since system endpoints are required for bootstrap data generation.","triggerScenarios":"cloud.GetApiIngressStatus returns an error: cloud API credentials missing/invalid, network outage from the controller to the cloud API, load balancer not yet provisioned so the provider returns NotFound, or the cluster spec lacks required fields (region/project) needed by BuildCloud (though those have separate errors).","commonSituations":"Running the clusterapi controller on GCP/AWS before the API load balancer exists; expired IAM/service-account credentials; controller pod without network egress to cloud APIs; cloud SDK quota or throttling errors during bursty reconciles.","solutions":["Verify the controller has valid cloud credentials (service account / IAM role) and network access to the cloud API","Check that the API load balancer for the cluster exists and is healthy in the cloud console","Inspect the wrapped inner error (%v) to identify whether it is auth, networking, or NotFound","Re-run reconcile after the load balancer finishes provisioning; the controller will retry"],"exampleFix":"// before\ningresses, err := cloud.GetApiIngressStatus(clusterInternal)\nif err != nil {\n    return nil, fmt.Errorf(\"error getting ingress status: %v\", err)\n}\n// after: tolerate not-yet-ready LBs and retry instead of failing hard\ningresses, err := cloud.GetApiIngressStatus(clusterInternal)\nif err != nil {\n    if apierrors.IsNotFound(err) || isTransientCloudError(err) {\n        return nil, ctrl.Result{RequeueAfter: 30 * time.Second}, nil // retry when LB is ready\n    }\n    return nil, fmt.Errorf(\"error getting ingress status: %v\", err)\n}","handlingStrategy":"retry","validationCode":"// before relying on reconcile, confirm cloud reachability\ncloud, err := cloudup.BuildCloud(clusterInternal)\nif err != nil { return err }\nif _, err := cloud.GetApiIngressStatus(clusterInternal); err != nil {\n    klog.Warningf(\"ingress status not yet available, will retry: %v\", err)\n}","typeGuard":null,"tryCatchPattern":"// caller side (controller):\nendpoints, err := s.findSystemEndpoints(ctx)\nif err != nil {\n    klog.Warningf(\"endpoints lookup failed, requeueing: %v\", err)\n    return ctrl.Result{RequeueAfter: 30 * time.Second}, nil\n}","preventionTips":["Ensure the controller pod's cloud credentials (IAM/service account) are valid and not expired","Verify network egress from the controller to cloud APIs before rollout","Wait for load-balancer readiness alerts before diagnosing controller errors","Log the wrapped inner error to distinguish auth vs network vs NotFound"],"tags":["cloud-api","load-balancer","gcp","controller"],"backgroundTag":"cloud-provider-api-error","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T07:17:12.445Z"}