{"record":{"id":"90042fc3dde1de23","repo":"kubernetes/kops","slug":"error-listing-nodes-in-cluster-v","errorCode":null,"errorMessage":"error listing nodes in cluster: %v","messagePattern":"error listing nodes in cluster: (.+?)","errorType":"error_code","errorClass":null,"httpStatus":null,"severity":"error","filePath":"cmd/kops/rolling-update_cluster.go","lineNumber":270,"sourceCode":"\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"getting rest config: %w\", err)\n\t\t}\n\n\t\thttpClient, err := f.HTTPClient(restConfig)\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"getting http client: %w\", err)\n\t\t}\n\n\t\tk8sClient, err = kubernetes.NewForConfigAndClient(restConfig, httpClient)\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"getting kubernetes client: %w\", err)\n\t\t}\n\n\t\tnodeList, err := k8sClient.CoreV1().Nodes().List(ctx, metav1.ListOptions{})\n\t\tif err != nil {\n\t\t\tfmt.Fprintf(os.Stderr, \"Unable to reach the kubernetes API.\\n\")\n\t\t\tfmt.Fprintf(os.Stderr, \"Use --cloudonly to do a rolling-update without confirming progress with the k8s API\\n\\n\")\n\t\t\treturn fmt.Errorf(\"error listing nodes in cluster: %v\", err)\n\t\t}\n\n\t\tif nodeList != nil {\n\t\t\tnodes = nodeList.Items\n\t\t}\n\t}\n\n\tlist, err := clientset.InstanceGroupsFor(cluster).List(ctx, metav1.ListOptions{})\n\tif err != nil {\n\t\treturn err\n\t}\n\n\tcountByRole := make(map[kopsapi.InstanceGroupRole]int32)\n\tvar instanceGroups []*kopsapi.InstanceGroup\n\tfor i := range list.Items {\n\t\tinstanceGroup := &list.Items[i]\n\t\tinstanceGroups = append(instanceGroups, instanceGroup)\n","sourceCodeStart":252,"sourceCodeEnd":288,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/cmd/kops/rolling-update_cluster.go#L252-L288","documentation":"After building the k8s client, RunRollingUpdateCluster lists all Nodes via k8sClient.CoreV1().Nodes().List(ctx, ...) to correlate cloud instances with cluster members. If that API call fails, the command prints an explicit hint about --cloudonly to stderr and returns \"error listing nodes in cluster: %v\". The k8s API server was unreachable or rejected the request.","triggerScenarios":"k8sClient.CoreV1().Nodes().List(ctx, metav1.ListOptions{}) fails: API server unreachable (network/VPN down, wrong endpoint), authentication/authorization failure (expired token or cert), or the API server itself is down — and --cloudonly was not passed.","commonSituations":"Running rolling-update from a machine without network access to the cluster VPC; expired admin credentials after certificate rotation; API server load balancer deleted or cluster actually down mid-migration; RBAC changes removing nodes/list permission.","solutions":["Restore connectivity to the API server (VPN/bastion/security groups) and confirm with kubectl get nodes","Regenerate admin credentials: kops export kubeconfig <cluster> --admin","Re-run with --cloudonly to perform the rolling update purely from cloud state without k8s API confirmation (nodes may be unreachable anyway)","Check API server health on the master instance groups / load balancer"],"exampleFix":"// before\nkops rolling-update cluster mycluster.k8s.local\n// error listing nodes in cluster: ... connection refused\n// after (no k8s access from this network)\nkops rolling-update cluster mycluster.k8s.local --cloudonly","handlingStrategy":"retry","validationCode":"// precheck API reachability before rolling-update\nclient, err := kubernetes.NewForConfig(restConfig)\nif err != nil { return err }\nctx, cancel := context.WithTimeout(context.Background(), 10*time.Second)\ndefer cancel()\nif _, err := client.Discovery().ServerVersion(); err != nil {\n    return fmt.Errorf(\"API server unreachable: %w\", err)\n}","typeGuard":null,"tryCatchPattern":"if _, err := client.CoreV1().Nodes().List(ctx, metav1.ListOptions{}); err != nil {\n    if apierrors.IsUnauthorized(err) || apierrors.IsForbidden(err) {\n        return fmt.Errorf(\"re-authenticate: kops export kubeconfig <cluster> --admin: %w\", err)\n    }\n    return fmt.Errorf(\"API unreachable, use --cloudonly or fix network: %w\", err)\n}","preventionTips":["Confirm VPN/bastion connectivity to the cluster VPC before maintenance","Keep admin credentials fresh; regenerate before long maintenance windows","Monitor API server health (kubectl get --raw /readyz) before rolling updates","Use --cloudonly for clusters whose API is intentionally down"],"tags":["kubernetes","api-server","network","rolling-update"],"backgroundTag":"kubernetes-api-unreachable","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T07:17:12.445Z"}