{"record":{"id":"b3017dbd49c517bb","repo":"kubernetes/kops","slug":"getting-vm-w","errorCode":null,"errorMessage":"getting VM: %w","messagePattern":"getting VM: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/nodeidentity/azure/client.go","lineNumber":84,"sourceCode":"\t\tvmssClient: vmssClient,\n\t}, nil\n}\n\nfunc (c *client) getVMTags(ctx context.Context, providerID string) (map[string]*string, error) {\n\tif !strings.HasPrefix(providerID, \"azure://\") {\n\t\treturn nil, fmt.Errorf(\"unknown providerID : %s\", providerID)\n\t}\n\n\tres, err := arm.ParseResourceID(strings.TrimPrefix(providerID, \"azure://\"))\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"error parsing providerID: %v\", err)\n\t}\n\n\tswitch res.ResourceType.String() {\n\tcase \"Microsoft.Compute/virtualMachines\":\n\t\tresp, err := c.vmClient.Get(ctx, res.ResourceGroupName, res.Name, nil)\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"getting VM: %w\", err)\n\t\t}\n\t\treturn resp.VirtualMachine.Tags, nil\n\tcase \"Microsoft.Compute/virtualMachineScaleSets/virtualMachines\":\n\t\tresp, err := c.vmssClient.Get(ctx, res.ResourceGroupName, res.Parent.Name, res.Name, nil)\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"getting VMSS VM: %w\", err)\n\t\t}\n\t\treturn resp.VirtualMachineScaleSetVM.Tags, nil\n\tdefault:\n\t\treturn nil, fmt.Errorf(\"unsupported resource type %q for %q\", res.ResourceType, providerID)\n\t}\n}\n","sourceCodeStart":66,"sourceCodeEnd":97,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/pkg/nodeidentity/azure/client.go#L66-L97","documentation":"When the parsed providerID identifies a standalone virtual machine (Microsoft.Compute/virtualMachines), getVMTags calls the VMs client Get API to fetch the VM (including its tags). If the Azure API call fails, the error is wrapped with 'getting VM'.","triggerScenarios":"c.vmClient.Get(ctx, resourceGroup, vmName, nil) returns an error — VM not found (ResourceNotFoundError), deleted VM whose Node object still exists, authz failure (no Reader role for the identity), or network/API errors.","commonSituations":"Node object orphaned after VM deletion or VMSS scale-in; managed identity lacking Reader on the VM's resource group; wrong subscription context (cluster moved between subscriptions); transient Azure API outages or throttling (429).","solutions":["Check the wrapped error: if it is a 404, the VM no longer exists — delete the stale Node object (kubectl delete node <name>)","Verify the credential has at least Reader role on the VM / its resource group","Confirm the VM exists in the portal or with az vm show -g <rg> -n <vm-name>","For 429/throttling or transient network errors, retry; check Azure status"],"exampleFix":null,"handlingStrategy":"retry","validationCode":"// verify the VM exists before the call\naz vm show -g <resource-group> -n <vm-name> -o none  # exit 0 means it exists","typeGuard":null,"tryCatchPattern":"resp, err := c.vmClient.Get(ctx, rg, name, nil)\nif err != nil {\n    var respErr *azcore.ResponseError\n    if errors.As(err, &respErr) && respErr.StatusCode == 404 {\n        // VM deleted; clean up the Node object instead of retrying\n    } else if respErr != nil && (respErr.StatusCode == 429 || respErr.StatusCode >= 500) {\n        // transient: retry with backoff\n    }\n    return fmt.Errorf(\"getting VM: %w\", err)\n}","preventionTips":["Grant the managed identity at least Reader on the resource group","Delete Node objects for deleted VMs promptly","Handle azcore.ResponseError to distinguish 404 from transient failures","Use retry/backoff for 429/5xx responses"],"tags":["azure","api","vm","permissions"],"backgroundTag":"azure-resource-not-found","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T07:17:12.445Z"}