{"record":{"id":"9bbf337ceba6e1dc","repo":"kubernetes/kops","slug":"listing-nodes-in-cluster-v","errorCode":null,"errorMessage":"listing nodes in cluster: %v","messagePattern":"listing nodes in cluster: (.+?)","errorType":"console","errorClass":null,"httpStatus":null,"severity":"error","filePath":"cmd/kops/delete_instance.go","lineNumber":285,"sourceCode":"\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"cannot create cluster validator: %v\", err)\n\t\t}\n\t}\n\td.ClusterValidator = clusterValidator\n\n\treturn d.UpdateSingleInstance(ctx, cloudMember, options.Surge)\n}\n\nfunc getNodes(ctx context.Context, kubeClient kubernetes.Interface, verbose bool) ([]v1.Node, error) {\n\tvar nodes []v1.Node\n\n\tnodeList, err := kubeClient.CoreV1().Nodes().List(ctx, metav1.ListOptions{})\n\tif err != nil {\n\t\tif verbose {\n\t\t\tfmt.Fprintf(os.Stderr, \"Unable to reach the kubernetes API.\\n\")\n\t\t\tfmt.Fprintf(os.Stderr, \"Use --cloudonly to do a deletion without confirming progress with the k8s API\\n\\n\")\n\t\t}\n\t\treturn nil, fmt.Errorf(\"listing nodes in cluster: %v\", err)\n\t}\n\n\tif nodeList != nil {\n\t\tnodes = nodeList.Items\n\t}\n\treturn nodes, nil\n}\n\nfunc deleteNodeMatch(cloudMember *cloudinstances.CloudInstance, options *DeleteInstanceOptions) bool {\n\treturn cloudMember.ID == options.InstanceID ||\n\t\t(!options.CloudOnly && cloudMember.Node != nil && cloudMember.Node.Name == options.InstanceID)\n}\n\nfunc findDeletionNode(groups map[string]*cloudinstances.CloudInstanceGroup, options *DeleteInstanceOptions) *cloudinstances.CloudInstance {\n\tfor _, group := range groups {\n\t\tfor _, r := range group.Ready {\n\t\t\tif deleteNodeMatch(r, options) {\n\t\t\t\treturn r","sourceCodeStart":267,"sourceCodeEnd":303,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/cmd/kops/delete_instance.go#L267-L303","documentation":"getNodes returns this when the List call against the CoreV1 Nodes API fails — i.e. the kubernetes API could not be reached or rejected the request. This is the k8s-API connectivity check performed before any instance deletion, and the error wraps the client-go failure (connection refused, timeout, TLS, auth).","triggerScenarios":"`kops delete instance` (no --cloudonly) where kubeClient.CoreV1().Nodes().List(ctx, metav1.ListOptions{}) errors: API server unreachable/down, DNS not resolving the API endpoint, security group/firewall blocking 443, expired or unauthorized client certificate (401/403), or context deadline exceeded.","commonSituations":"Deleting an instance in a cluster whose API server is down or being upgraded; running kops from a network that cannot reach the API endpoint (VPN off, security group restriction); expired admin kubecfg credentials; masters unhealthy so the API endpoint fails health checks; slow WAN causing context timeout.","solutions":["If the instance cannot reach the API anyway, re-run with --cloudonly to skip the k8s API entirely (the CLI itself prints this hint).","Test connectivity: `kubectl --kubeconfig <kubecfg> get nodes` — fix DNS/firewall/security-group until it works.","Refresh credentials: `kops export kubecfg <cluster> --admin` if you get 401/403 or certificate-expiry errors.","Check API server health: `kops validate cluster` and the load balancer / master instances in the cloud console.","Read the wrapped error to distinguish network (connection refused/timeout) from auth (Unauthorized/Forbidden) and fix accordingly."],"exampleFix":"// before\nkops delete instance --name mycluster.example.com i-0abc123\n// error: listing nodes in cluster: ... connection refused\n// after (when API is intentionally unreachable)\nkops delete instance --name mycluster.example.com i-0abc123 --cloudonly --yes\n// or fix access first:\n// $ kops export kubecfg mycluster.example.com --admin && kubectl get nodes","handlingStrategy":"retry","validationCode":"// probe API reachability before the delete flow:\nprobeCtx, cancel := context.WithTimeout(ctx, 10*time.Second)\ndefer cancel()\nif _, err := k8sClient.Discovery().ServerVersion(); err != nil {\n    return fmt.Errorf(\"kubernetes API unreachable (%v); use --cloudonly or restore connectivity\", err)\n}","typeGuard":null,"tryCatchPattern":"nodeList, err := kubeClient.CoreV1().Nodes().List(ctx, metav1.ListOptions{})\nif err != nil {\n    if apierrors.IsUnauthorized(err) || apierrors.IsForbidden(err) {\n        return nil, fmt.Errorf(\"listing nodes in cluster: auth rejected (%v); run 'kops export kubecfg --admin'\", err)\n    }\n    if errors.Is(err, context.DeadlineExceeded) {\n        return nil, fmt.Errorf(\"listing nodes in cluster: API timeout; check network/security groups\")\n    }\n    return nil, fmt.Errorf(\"listing nodes in cluster: %v\", err)\n}","preventionTips":["Run `kops validate cluster` before instance deletions to confirm API health.","Export fresh admin credentials (`kops export kubecfg --admin`) before maintenance windows.","Ensure the network you run kops from can reach the API endpoint (VPN, security groups, port 443).","Avoid deleting instances during master upgrades when the API server may be down; use --cloudonly as a fallback."],"tags":["kubernetes","api-server","network","connectivity"],"backgroundTag":"api-server-unreachable","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T07:17:12.445Z"}