{"record":{"id":"b20ae41e9d553ce9","repo":"kubernetes/kops","slug":"error-listing-ip-addresses-v","errorCode":null,"errorMessage":"error listing IP Addresses: %v","messagePattern":"error listing IP Addresses: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"upup/pkg/fi/cloudup/gcetasks/address.go","lineNumber":71,"sourceCode":"func (e *Address) Find(c *fi.CloudupContext) (*Address, error) {\n\tactual, err := e.find(c.T.Cloud.(gce.GCECloud))\n\tif actual != nil && err == nil {\n\t\tif e.IPAddress == nil {\n\t\t\te.IPAddress = actual.IPAddress\n\t\t}\n\n\t\t// Ignore system fields\n\t\tactual.Lifecycle = e.Lifecycle\n\t\tactual.WellKnownServices = e.WellKnownServices\n\t}\n\treturn actual, err\n}\n\nfunc findAddressByIP(cloud gce.GCECloud, ip string, subnet string) (*Address, error) {\n\t// Technically this is a regex, but it doesn't matter, it's a prefilter\n\taddrs, err := cloud.Compute().Addresses().ListWithFilter(cloud.Project(), cloud.Region(), \"address eq \"+ip)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"error listing IP Addresses: %v\", err)\n\t}\n\n\tvar matches []*compute.Address\n\tfor _, addr := range addrs {\n\t\tif subnet != \"\" && addr.Subnetwork != subnet {\n\t\t\tcontinue\n\t\t}\n\t\tif addr.Address == ip {\n\t\t\tmatches = append(matches, addr)\n\t\t}\n\t}\n\n\tif len(matches) == 0 {\n\t\treturn nil, nil\n\t}\n\n\tif len(matches) > 1 {\n\t\treturn nil, fmt.Errorf(\"found multiple Addresses matching %q\", ip)","sourceCodeStart":53,"sourceCodeEnd":89,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/upup/pkg/fi/cloudup/gcetasks/address.go#L53-L89","documentation":"findAddressByIP wraps an error returned by the GCE Compute API when listing static IP addresses with the filter \"address eq <ip>\". Any non-HTTP-200 response from Addresses().ListWithFilter — auth failures, quota issues, API outages, malformed requests — is surfaced with this message. It propagates up to the Find method of the Address task, failing the refresh/reconcile phase.","triggerScenarios":"Addresses().ListWithFilter(project, region, \"address eq \"+ip) returns err != nil during findAddressByIP (called from Find): expired credentials, API disabled (compute.googleapis.com), transient 5xx/429 responses, or an unparseable/invalid filter value for the IP string.","commonSituations":"GCP credentials revoked or service account lacking compute.addresses.list permission, compute API disabled on the project, GCE regional outage or rate limiting, or running kops against a project/region whose API endpoint errors.","solutions":["Inspect the wrapped %v cause; if it's a 403/permission error, grant the service account roles/compute.networkAdmin (or compute.viewer at minimum).","Verify the Compute Engine API is enabled: `gcloud services enable compute.googleapis.com --project=<project>`.","Re-authenticate: `gcloud auth application-default login` or fix GOOGLE_APPLICATION_CREDENTIALS / the credential chain kops uses.","For 429/5xx causes, retry the `kops update cluster` run after the transient condition clears.","If the IP value came from the spec, confirm it is a well-formed address string so the eq filter is valid."],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":"out, err := exec.Command(\"gcloud\", \"services\", \"list\", \"--project\", project, \"--filter\", \"name:compute.googleapis.com\").CombinedOutput()\nif err != nil || !strings.Contains(string(out), \"compute.googleapis.com\") {\n    return fmt.Errorf(\"compute API not enabled/accessible for project %s\", project)\n}","typeGuard":null,"tryCatchPattern":"if err := runKopsUpdate(); err != nil {\n    if strings.Contains(err.Error(), \"error listing IP Addresses\") {\n        // inspect wrapped cause: check credentials, compute API enabled, retry on 429/5xx\n        if isRateLimit(err) { time.Sleep(backoff); retry() }\n    }\n}","preventionTips":["Grant the kops service account compute.addresses.list via roles/compute.networkAdmin before applying.","Run `gcloud auth application-default login` / verify GOOGLE_APPLICATION_CREDENTIALS before long applies.","Enable compute.googleapis.com on the target project.","Wrap kops update runs with retry/backoff to survive transient 429/5xx."],"tags":["gce","api","networking","static-ip"],"backgroundTag":"gce-api-call-failed","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T07:17:12.445Z"}