{"record":{"id":"da54c17a3e5fbeec","repo":"kubernetes/kops","slug":"error-on-getting-vm-scaleset-s","errorCode":null,"errorMessage":"error on getting VM ScaleSet: %s","messagePattern":"error on getting VM ScaleSet: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/nodeidentity/azure/identify.go","lineNumber":98,"sourceCode":"\tvmName, err := getVMNameFromProviderID(providerID)\n\tif err != nil {\n\t\treturn nil, err\n\t}\n\n\t// If caching is enabled, try pulling nodeidentity.Info from the cache before doing an API call.\n\tif i.cacheEnabled {\n\t\tobj, exists, err := i.cache.GetByKey(vmName)\n\t\tif err != nil {\n\t\t\tklog.Warningf(\"Nodeidentity info cache lookup failure: %v\", err)\n\t\t}\n\t\tif exists {\n\t\t\treturn obj.(*nodeidentity.Info), nil\n\t\t}\n\t}\n\n\ttags, err := i.azureClient.getVMTags(ctx, providerID)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"error on getting VM ScaleSet: %s\", err)\n\t}\n\n\tlabels := map[string]string{}\n\tfor k, v := range tags {\n\t\tif k == azure.TagClusterName && v != nil {\n\t\t\tlabels[kops.LabelClusterName] = *v\n\t\t}\n\t\tif k == InstanceGroupNameTag && v != nil {\n\t\t\tlabels[kops.NodeLabelInstanceGroup] = *v\n\t\t}\n\t\tif strings.HasPrefix(k, azure.TagNameRolePrefix) {\n\t\t\trole := strings.TrimPrefix(k, azure.TagNameRolePrefix)\n\t\t\tswitch role {\n\t\t\tcase kops.InstanceGroupRoleControlPlane.ToLowerString():\n\t\t\t\tlabels[nodelabels.RoleLabelControlPlane20] = \"\"\n\t\t\tcase \"master\":\n\t\t\t\tlabels[nodelabels.RoleLabelControlPlane20] = \"\"\n\t\t\tcase kops.InstanceGroupRoleNode.ToLowerString():","sourceCodeStart":80,"sourceCodeEnd":116,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/pkg/nodeidentity/azure/identify.go#L80-L116","documentation":"After a cache miss, IdentifyNode fetches the VM's tags via azureClient.getVMTags to derive cluster/instance-group labels. When that Azure API call fails, the underlying error is wrapped as \"error on getting VM ScaleSet: %s\". The message is historical (it may fire for plain VMs too); the root cause is in the wrapped Azure SDK error (auth, network, throttling, or not-found).","triggerScenarios":"IdentifyNode called on an azure:// node with an empty identity cache and getVMTags fails: invalid Azure credentials/service principal, network egress blocked to Azure ARM endpoints, ARM rate limiting (429), the VM was deleted, or wrong subscription configuration.","commonSituations":"Expired or rotated service-principal credentials; cluster VNet lacking outbound access to management.azure.com; Azure API throttling during scale-up storms of VMSS instances; misconfigured azure.conf (subscription ID / tenant mismatch) in kOps cluster spec.","solutions":["Inspect the wrapped %s detail: fix Azure auth (az credential validity, service principal roles Reader on the VM/VMSS resource group).","Confirm network egress from the node/control plane to management.azure.com:443.","Check azure configuration in the cluster spec (subscriptionID, tenantID, resourceGroup) matches where the VMs live.","For 429 throttling, add backoff/retry or rely on the identity cache; retry IdentifyNode after the transient failure."],"exampleFix":null,"handlingStrategy":"retry","validationCode":"if err := azureClient.verifyCredentials(ctx); err != nil {\n    return fmt.Errorf(\"azure credentials invalid before VM tag lookup: %w\", err)\n}","typeGuard":null,"tryCatchPattern":"info, err := identifier.IdentifyNode(ctx, node)\nif err != nil && strings.Contains(err.Error(), \"error on getting VM ScaleSet\") {\n    // transient ARM/auth failure: backoff and retry\n    return retryWithBackoff(3, func() error {\n        _, err = identifier.IdentifyNode(ctx, node)\n        return err\n    })\n}","preventionTips":["Grant the service principal Reader on the VM/VMSS resource groups","Monitor and alert on ARM 429 throttling; keep the identity cache enabled","Ensure outbound HTTPS to management.azure.com from all nodes","Rotate Azure credentials before expiry and update cluster spec"],"tags":["azure","api-error","vm","authentication","kops"],"backgroundTag":"azure-api-request-failed","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T07:17:12.445Z"}