{"record":{"id":"9d8787a2f5b3f388","repo":"kubernetes/kops","slug":"getting-cluster-control-plane-vmss-for-api-ingress","errorCode":null,"errorMessage":"getting cluster control plane VMSS for API ingress status: %w","messagePattern":"getting cluster control plane VMSS for API ingress status: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"upup/pkg/fi/cloudup/azure/azure_cloud.go","lineNumber":323,"sourceCode":"\t\t\t\t\t}\n\t\t\t\t\tfor _, pip := range pips {\n\t\t\t\t\t\tif pip.ID == nil || pip.Properties == nil || pip.Properties.IPAddress == nil || *pip.ID != *i.Properties.PublicIPAddress.ID {\n\t\t\t\t\t\t\tcontinue\n\t\t\t\t\t\t}\n\t\t\t\t\t\tingresses = append(ingresses, fi.ApiIngressStatus{\n\t\t\t\t\t\t\tIP: *pip.Properties.IPAddress,\n\t\t\t\t\t\t})\n\t\t\t\t\t}\n\t\t\t\tdefault:\n\t\t\t\t\treturn nil, fmt.Errorf(\"unknown load balancer type: %q\", lbSpec.Type)\n\t\t\t\t}\n\t\t\t}\n\t\t}\n\t} else {\n\t\t// Get scale sets in cluster resource group and find masters scale set\n\t\tscaleSets, err := c.vmscaleSetsClient.List(context.TODO(), rg)\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"getting cluster control plane VMSS for API ingress status: %w\", err)\n\t\t}\n\t\tvar vmssName string\n\t\tfor _, scaleSet := range scaleSets {\n\t\t\tval, ok := scaleSet.Tags[TagClusterName]\n\t\t\tval2, ok2 := scaleSet.Tags[TagNameRolePrefix+TagRoleControlPlane]\n\t\t\tval3, ok3 := scaleSet.Tags[TagNameRolePrefix+TagRoleMaster]\n\t\t\tif ok && *val == cluster.Name && (ok2 && *val2 == \"1\" || ok3 && *val3 == \"1\") {\n\t\t\t\tvmssName = *scaleSet.Name\n\t\t\t\tbreak\n\t\t\t}\n\t\t}\n\t\tif vmssName == \"\" {\n\t\t\treturn nil, fmt.Errorf(\"getting control plane VMSS name for API ingress status\")\n\t\t}\n\n\t\t// Get masters scale set network interfaces and append to api ingress status\n\t\tnis, err := c.NetworkInterface().ListScaleSetsNetworkInterfaces(context.TODO(), rg, vmssName)\n\t\tif err != nil {","sourceCodeStart":305,"sourceCodeEnd":341,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/upup/pkg/fi/cloudup/azure/azure_cloud.go#L305-L341","documentation":"kOps wraps the Azure SDK error returned while listing virtual machine scale sets in the cluster resource group when resolving the API (control plane) ingress status. If the List call on vmscaleSetsClient fails — due to auth, network, or an API error — the underlying error is wrapped with %w and returned to the caller of GetApiIngressStatus. It indicates kOps could not enumerate the control plane VMSS to find load balancer backends.","triggerScenarios":"Calling cloud.GetApiIngressStatus() on an Azure cluster whose control plane runs as a VMSS, when vmscaleSetsClient.List(ctx, rg) fails for the cluster resource group (rg). This happens on Azure API errors: invalid/missing credentials, throttling (429), network failure, or a nonexistent/mismatched resource group.","commonSituations":"Expired or misconfigured Azure credentials (AZURE_CLIENT_ID/SECRET/TENANT); running `kops get clusters`/validate commands against a cluster whose resource group was renamed or deleted; Azure rate limiting during concurrent kOps operations; transient network failures to management.azure.com.","solutions":["Fix Azure credentials (az login, or verify the service principal used by kOps has Reader on the cluster resource group).","Retry the command; transient Azure API failures and throttling are a common cause.","Verify the cluster resource group exists and matches the cluster spec (az group show -g <rg>).","Check network/proxy connectivity from the machine running kOps to management.azure.com.","Inspect the wrapped cause (%w chain) for the specific Azure error code (e.g. AuthorizationFailed, ParentResourceNotFound)."],"exampleFix":"null","handlingStrategy":"try-catch","validationCode":"// Go: verify credentials and resource group access before the call\ncred, err := azidentity.NewDefaultAzureCredential(nil)\nif err != nil { return err }\nrgClient := armresources.NewResourceGroupsClient(subID, cred, nil)\nif _, err := rgClient.Get(ctx, clusterResourceGroup, nil); err != nil {\n    return fmt.Errorf(\"resource group %s not accessible: %w\", clusterResourceGroup, err)\n}","typeGuard":"func isAzureAuthErr(err error) bool {\n    var respErr *azcore.ResponseError\n    return errors.As(err, &respErr) && respErr.StatusCode == 401\n}","tryCatchPattern":"status, err := cloud.GetApiIngressStatus(cluster)\nif err != nil {\n    if strings.Contains(err.Error(), \"getting cluster control plane VMSS\") {\n        // inspect wrapped Azure cause, retry with backoff or fix credentials\n        log.Printf(\"Azure API failure resolving ingress status: %v\", err)\n    }\n    return err\n}","preventionTips":["Keep Azure credentials fresh (az login / valid service principal) on the host running kOps.","Grant the principal Reader on the cluster resource group before operations.","Avoid bulk concurrent kOps invocations that could hit Azure throttling limits.","Verify the cluster resource group exists and matches the cluster name before running kOps commands.","Retain the full error chain (%w) when logging to see the Azure cause."],"tags":["azure","api-ingress","vmss","cloud-api"],"backgroundTag":"azure-api-request-failed","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T07:17:12.445Z"}