{"record":{"id":"8a94ab96cb2ecfde","repo":"kubernetes/kops","slug":"error-listing-nodes-v-8a94ab","errorCode":null,"errorMessage":"error listing nodes: %v","messagePattern":"error listing nodes: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/validation/validate_cluster.go","lineNumber":184,"sourceCode":"\t\tif hasPlaceHolderIPAddress != \"\" {\n\t\t\tmessage := fmt.Sprintf(\"Validation Failed\\n\\n\"+\n\t\t\t\t\"The %[1]v Kubernetes deployment has not updated the Kubernetes cluster's API DNS entry to the correct IP address.\"+\n\t\t\t\t\"  The API DNS IP address is the placeholder address that kops creates: %[2]v.\"+\n\t\t\t\t\"  Please wait about 5-10 minutes for a control plane node to start, %[1]v to launch, and DNS to propagate.\"+\n\t\t\t\t\"  The %[1]v deployment logs may contain more diagnostic information.\"+\n\t\t\t\t\"  Etcd and the API DNS entries must be updated for a kops Kubernetes cluster to start.\", dnsProvider, hasPlaceHolderIPAddress)\n\t\t\tvalidation.addError(&ValidationError{\n\t\t\t\tKind:    \"dns\",\n\t\t\t\tName:    \"apiserver\",\n\t\t\t\tMessage: message,\n\t\t\t})\n\t\t\treturn validation, nil\n\t\t}\n\t}\n\n\tnodeList, err := v.k8sClient.CoreV1().Nodes().List(ctx, metav1.ListOptions{})\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"error listing nodes: %v\", err)\n\t}\n\n\twarnUnmatched := false\n\tcloudGroups, err := v.cloud.GetCloudGroups(v.cluster, v.allInstanceGroups, warnUnmatched, nodeList.Items)\n\tif err != nil {\n\t\treturn nil, err\n\t}\n\n\tvar toleratedNodes map[string]bool\n\tif v.maxUnreadyNodes > 0 {\n\t\tvar notReadyWorkerNodes []string\n\t\tfor _, cloudGroup := range cloudGroups {\n\t\t\tif cloudGroup.InstanceGroup != nil && cloudGroup.InstanceGroup.Spec.Role.HasNode() {\n\t\t\t\tvar allMembers []*cloudinstances.CloudInstance\n\t\t\t\tallMembers = append(allMembers, cloudGroup.Ready...)\n\t\t\t\tallMembers = append(allMembers, cloudGroup.NeedUpdate...)\n\n\t\t\t\tfor _, member := range allMembers {","sourceCodeStart":166,"sourceCodeEnd":202,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/pkg/validation/validate_cluster.go#L166-L202","documentation":"ClusterValidator.Validate lists all Nodes from the live cluster via the Kubernetes API to correlate them with cloud groups and instance groups. If the Nodes().List call fails, this error wraps the client error. Since node listing is foundational to validation, the whole validation fails rather than returning partial results.","triggerScenarios":"v.k8sClient.CoreV1().Nodes().List(ctx, ...) returns an error: expired/insufficient credentials, RBAC denying node list, API server unreachable, or context timeout/cancellation.","commonSituations":"kubeconfig points to the wrong context or an expired OIDC token; validating an internal-API cluster from outside the VPC; RBAC user lacking cluster-scoped nodes list permission; API server briefly down during an upgrade.","solutions":["Run kubectl get nodes with the same kubeconfig to reproduce and read the raw error (auth vs network vs RBAC)","Fix credentials: kops export kubecfg <cluster> or refresh OIDC/SSO tokens","If RBAC, grant the user/serviceaccount list permission on nodes at cluster scope","If network, run validation from inside the VPC or fix the API endpoint reachability; retry after transient API server issues"],"exampleFix":"// before\n$ kops validate cluster\n# error listing nodes: Unauthorized\n// after\n$ kops export kubecfg prod.example.com\n$ kubectl get nodes   # works\n$ kops validate cluster","handlingStrategy":"retry","validationCode":"_, err := k8sClient.CoreV1().Nodes().List(ctx, metav1.ListOptions{})\nif err != nil {\n    return fmt.Errorf(\"precondition failed, cannot list nodes: %v\", err)\n}","typeGuard":null,"tryCatchPattern":"err := wait.PollImmediate(5*time.Second, 2*time.Minute, func() (bool, error) {\n    _, err := v.k8sClient.CoreV1().Nodes().List(ctx, metav1.ListOptions{})\n    if err != nil {\n        if apierrors.IsUnauthorized(err) || apierrors.IsForbidden(err) {\n            return false, err // not retryable\n        }\n        return false, nil // transient, retry\n    }\n    return true, nil\n})","preventionTips":["Refresh kubeconfig credentials (kops export kubecfg) before validation in CI","Ensure the validating identity has cluster-scope node list RBAC","Run validation with network access to the API endpoint","Use generous context timeouts on large clusters"],"tags":["go","kubernetes","nodes","rbac","kops"],"backgroundTag":"kubernetes-api-request-failed","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T07:17:12.445Z"}