{"record":{"id":"ed0e6fd6e9164ab5","repo":"kubernetes/kops","slug":"getting-control-plane-vmss-network-interfaces-for","errorCode":null,"errorMessage":"getting control plane VMSS network interfaces for API ingress status: %w","messagePattern":"getting control plane VMSS network interfaces for API ingress status: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"upup/pkg/fi/cloudup/azure/azure_cloud.go","lineNumber":342,"sourceCode":"\t\t}\n\t\tvar vmssName string\n\t\tfor _, scaleSet := range scaleSets {\n\t\t\tval, ok := scaleSet.Tags[TagClusterName]\n\t\t\tval2, ok2 := scaleSet.Tags[TagNameRolePrefix+TagRoleControlPlane]\n\t\t\tval3, ok3 := scaleSet.Tags[TagNameRolePrefix+TagRoleMaster]\n\t\t\tif ok && *val == cluster.Name && (ok2 && *val2 == \"1\" || ok3 && *val3 == \"1\") {\n\t\t\t\tvmssName = *scaleSet.Name\n\t\t\t\tbreak\n\t\t\t}\n\t\t}\n\t\tif vmssName == \"\" {\n\t\t\treturn nil, fmt.Errorf(\"getting control plane VMSS name for API ingress status\")\n\t\t}\n\n\t\t// Get masters scale set network interfaces and append to api ingress status\n\t\tnis, err := c.NetworkInterface().ListScaleSetsNetworkInterfaces(context.TODO(), rg, vmssName)\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"getting control plane VMSS network interfaces for API ingress status: %w\", err)\n\t\t}\n\t\tfor _, ni := range nis {\n\t\t\tif ni.Properties == nil || ni.Properties.Primary == nil || !*ni.Properties.Primary {\n\t\t\t\tcontinue\n\t\t\t}\n\t\t\tfor _, i := range ni.Properties.IPConfigurations {\n\t\t\t\tif i.Properties == nil || i.Properties.PrivateIPAddress == nil {\n\t\t\t\t\tcontinue\n\t\t\t\t}\n\t\t\t\tingresses = append(ingresses, fi.ApiIngressStatus{\n\t\t\t\t\tIP: *i.Properties.PrivateIPAddress,\n\t\t\t\t})\n\t\t\t}\n\t\t}\n\t\tif ingresses == nil {\n\t\t\treturn nil, fmt.Errorf(\"getting API ingress status\")\n\t\t}\n\t}","sourceCodeStart":324,"sourceCodeEnd":360,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/upup/pkg/fi/cloudup/azure/azure_cloud.go#L324-L360","documentation":"After locating the control plane VMSS, GetApiIngressStatus lists its network interfaces via NetworkInterface().ListScaleSetsNetworkInterfaces. This error wraps any failure from that Azure API call. It indicates kOps found the scale set but could not enumerate its NICs to collect private IP addresses for the API ingress status.","triggerScenarios":"GetApiIngressStatus calls ListScaleSetsNetworkInterfaces(ctx, rg, vmssName) and it returns an error: Azure API failure (auth, throttling, network) or the scale set/VMSS name no longer exists in the resource group by the time the NIC list call runs.","commonSituations":"Control plane VMSS deleted or renamed between the List and NIC-list calls (race during cluster teardown); Azure throttling during bulk operations; transient management-plane network errors; RBAC changes removing read access to network interfaces.","solutions":["Re-run the command after confirming the cluster still exists (race/teardown scenarios usually self-resolve).","Verify the service principal has Reader (or Network Contributor) on the resource group / Microsoft.Network access.","Check the wrapped Azure error for throttling codes (429) and retry with backoff.","Confirm the VMSS name found via tags still exists: az vmss show -g <rg> -n <vmssName>.","Check connectivity/proxy settings to management.azure.com."],"exampleFix":"null","handlingStrategy":"retry","validationCode":"// Go: verify the VMSS still exists and RBAC allows listing NICs before the call\nvmssClient, _ := armcompute.NewVirtualMachineScaleSetsClient(subID, cred, nil)\nif _, err := vmssClient.Get(ctx, rg, vmssName, nil); err != nil {\n    return fmt.Errorf(\"scale set %s gone or inaccessible: %w\", vmssName, err)\n}","typeGuard":"func isThrottled(err error) bool {\n    var respErr *azcore.ResponseError\n    return errors.As(err, &respErr) && respErr.StatusCode == 429\n}","tryCatchPattern":"status, err := cloud.GetApiIngressStatus(cluster)\nif err != nil && strings.Contains(err.Error(), \"network interfaces for API ingress status\") {\n    if isThrottled(errors.Unwrap(err)) {\n        time.Sleep(retryAfter) // honor Retry-After, then retry\n    }\n    return err\n}","preventionTips":["Don't tear down or rename the control plane VMSS while status/validate commands run.","Retry with exponential backoff on 429/transient Azure errors.","Grant Microsoft.Network read permissions to the kOps service principal.","Avoid deleting cluster NICs manually; let kOps manage networking.","Check proxy/firewall stability for long-running kOps operations."],"tags":["azure","network-interfaces","vmss","api-ingress"],"backgroundTag":"azure-api-request-failed","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T07:17:12.445Z"}