{"record":{"id":"b8f9bee5a379a1c3","repo":"VictoriaMetrics/VictoriaMetrics","slug":"cannot-discover-kuma-targets-w","errorCode":null,"errorMessage":"cannot discover Kuma targets: %w","messagePattern":"cannot discover Kuma targets: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"lib/promscrape/discovery/kuma/api.go","lineNumber":95,"sourceCode":"\n\tcfg := &apiConfig{\n\t\tclient:   client,\n\t\tclientID: clientID,\n\t\tapiPath:  apiPath,\n\n\t\tfetchErrors: metrics.GetOrCreateCounter(fmt.Sprintf(`promscrape_discovery_kuma_errors_total{type=\"fetch\",url=%q}`, sdc.Server)),\n\t\tparseErrors: metrics.GetOrCreateCounter(fmt.Sprintf(`promscrape_discovery_kuma_errors_total{type=\"parse\",url=%q}`, sdc.Server)),\n\t}\n\n\tctx, cancel := context.WithCancel(context.Background())\n\tcfg.cancel = cancel\n\n\t// Initialize targets synchronously and then start updating them in background.\n\t// The synchronous targets' update is needed for returning non-empty list of targets\n\t// just after the initialization.\n\tif err := cfg.updateTargetsLabels(ctx); err != nil {\n\t\tclient.Stop()\n\t\treturn nil, fmt.Errorf(\"cannot discover Kuma targets: %w\", err)\n\t}\n\tcfg.wg.Go(func() {\n\t\tcfg.runTargetsWatcher(ctx)\n\t})\n\n\treturn cfg, nil\n}\n\nfunc getAPIServerPath(serverURL string) (string, string, error) {\n\tif serverURL == \"\" {\n\t\treturn \"\", \"\", fmt.Errorf(\"missing server url\")\n\t}\n\tif !strings.Contains(serverURL, \"://\") {\n\t\tserverURL = \"http://\" + serverURL\n\t}\n\tpsu, err := url.Parse(serverURL)\n\tif err != nil {\n\t\treturn \"\", \"\", fmt.Errorf(\"cannot parse server url=%q: %w\", serverURL, err)","sourceCodeStart":77,"sourceCodeEnd":113,"githubUrl":"https://github.com/VictoriaMetrics/VictoriaMetrics/blob/5079fb58f1e8e62113f90c945ad71586c797d770/lib/promscrape/discovery/kuma/api.go#L77-L113","documentation":"During Kuma SD initialization, targets are fetched synchronously once so the first scrape has data. If updateTargetsLabels(ctx) fails (network error, non-200 from the control plane, bad xDS/mesh response), initialization aborts, the client is stopped, and the error is wrapped with this message. It means the initial Kuma target discovery failed.","triggerScenarios":"Kuma control plane unreachable (DNS failure, connection refused, TLS handshake error) or returning invalid data when vmagent starts with a kuma_sd_config.","commonSituations":"Control plane not yet up during vmagent startup (ordering issue in k8s); wrong port; network policy/firewall blocking; expired control-plane mTLS certificates.","solutions":["Verify the Kuma control plane address/port is reachable from vmagent (curl http://kuma-cp:5676) and fix the `server` value","Check the wrapped error to distinguish connection refused/DNS/TLS from bad response data","Ensure startup ordering (vmagent starts after the control plane) or retry deployment","Inspect control-plane TLS certs and vmagent's CA configuration if handshake errors appear"],"exampleFix":"# before: vmagent starts before kuma-cp exists\nserver: \"http://kuma-control-plane:5676\"\n# after: add readiness gating / correct address\nserver: \"http://kuma-control-plane.kuma-system.svc:5676\"","handlingStrategy":"retry","validationCode":"addr := strings.TrimPrefix(strings.TrimPrefix(server, \"http://\"), \"https://\")\nconn, err := net.DialTimeout(\"tcp\", addr, 3*time.Second)\nif err != nil {\n    return fmt.Errorf(\"kuma control plane %s not reachable: %w\", addr, err)\n}\nconn.Close()","typeGuard":null,"tryCatchPattern":"for attempt := 0; attempt < 5; attempt++ {\n    ac, err := kuma.NewSDConfig(sdc)\n    if err == nil {\n        return ac, nil\n    }\n    if strings.Contains(err.Error(), \"cannot discover Kuma targets\") {\n        time.Sleep(time.Duration(attempt+1) * 2 * time.Second)\n        continue\n    }\n    return nil, err\n}\nreturn nil, errors.New(\"kuma control plane unreachable after retries\")","preventionTips":["Gate vmagent startup on Kuma control-plane readiness","Verify DNS/service name and port from inside the vmagent pod","Check NetworkPolicies/firewalls between vmagent and the control plane","Monitor control-plane mTLS certificate expiry"],"tags":["kuma","network","promscrape","service-discovery","startup"],"backgroundTag":"control-plane-unreachable","analyzedSha":"5079fb58f1e8e62113f90c945ad71586c797d770","analyzedAt":"2026-09-03T18:10:26.153Z","contentChangedAt":"2026-09-03T18:10:26.153Z","schemaVersion":2},"datasetVersion":"2026-09-08T15:18:49.778Z"}