{"record":{"id":"f8731e3cc40bce06","repo":"kubernetes/kops","slug":"failed-to-get-ip-for-server-q-w","errorCode":null,"errorMessage":"failed to get IP for server %q: %w","messagePattern":"failed to get IP for server %q: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"upup/pkg/fi/cloudup/scaleway/verifier.go","lineNumber":109,"sourceCode":"\t}\n\n\tserverResponse, err := instance.NewAPI(scwClient).GetServer(&instance.GetServerRequest{\n\t\tServerID: serverID,\n\t\tZone:     zone,\n\t}, scw.WithContext(ctx))\n\tif err != nil || serverResponse == nil || serverResponse.Server == nil {\n\t\treturn nil, fmt.Errorf(\"failed to get server %s: %w\", serverID, err)\n\t}\n\tserver := serverResponse.Server\n\n\tips, err := ipam.NewAPI(scwClient).ListIPs(&ipam.ListIPsRequest{\n\t\tRegion:     region,\n\t\tResourceID: new(server.ID),\n\t\tIsIPv6:     new(false),\n\t\tZonal:      new(zone.String()),\n\t}, scw.WithContext(ctx), scw.WithAllPages())\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"failed to get IP for server %q: %w\", server.Name, err)\n\t}\n\tif ips.TotalCount == 0 {\n\t\treturn nil, fmt.Errorf(\"no IP found for server %q: %w\", server.Name, err)\n\t}\n\n\taddresses := []string(nil)\n\tchallengeEndPoints := []string(nil)\n\tfor _, ip := range ips.IPs {\n\t\taddresses = append(addresses, ip.Address.IP.String())\n\t\tchallengeEndPoints = append(challengeEndPoints, net.JoinHostPort(ip.Address.IP.String(), strconv.Itoa(wellknownports.NodeupChallenge)))\n\t}\n\n\tresult := &bootstrap.VerifyResult{\n\t\tNodeName:          server.Name,\n\t\tInstanceGroupName: InstanceGroupNameFromTags(server.Tags),\n\t\tCertificateNames:  addresses,\n\t\tChallengeEndpoint: challengeEndPoints[0],\n\t}","sourceCodeStart":91,"sourceCodeEnd":127,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/upup/pkg/fi/cloudup/scaleway/verifier.go#L91-L127","documentation":"After fetching the server, VerifyToken lists its IPv4 addresses via the IPAM API (ListIPs with WithAllPages). Any error from that paginated call is wrapped in this message and fails token verification.","triggerScenarios":"ipam.ListIPs returns an error — typically an IAM permission problem on the IPAM API, an invalid region/zone scoping (region derived from zone is wrong for the resource), or a transient Scaleway API failure.","commonSituations":"The control-plane Scaleway credentials lack IPAM read permission (post-2023 IPAM is mandatory for flexible IPs), the server has no private IPAM entry because it was created outside IPAM, or an API outage/rate limit.","solutions":["Grant the control-plane IAM policy IPAM read permission (ipam_ips:list) in the Scaleway console","Verify the IPAM API returns the IP manually: scw ipam ip list project-id=<id> resource-id=<server-id>","Retry the bootstrap after a transient API failure/rate limit"],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":"// preflight: check IPAM list permission by listing IPs for the project\nips, err := ipam.NewAPI(scwClient).ListIPs(&ipam.ListIPsRequest{ProjectID: &projectID}, scw.WithContext(ctx))\nif err != nil {\n\tvar rerr *scw.ResponseError\n\tif errors.As(err, &rerr) && rerr.StatusCode == 403 {\n\t\tlog.Fatal(\"missing IPAM read permission on control-plane credentials\")\n\t}\n}","typeGuard":"func isPermissionDenied(err error) bool {\n\tvar rerr *scw.ResponseError\n\treturn errors.As(err, &rerr) && rerr.StatusCode == 403\n}","tryCatchPattern":"if err != nil {\n\tvar rerr *scw.ResponseError\n\tif errors.As(err, &rerr) && (rerr.StatusCode == 429 || rerr.StatusCode >= 500) {\n\t\t// transient: retry with backoff\n\t}\n\treturn fmt.Errorf(\"failed to get IP for server %q: %w\", server.Name, err)\n}","preventionTips":["Grant ipam_ips:list to the kOps control-plane IAM policy","Add retry-with-backoff for 429/5xx from Scaleway APIs","Use post-2023 IPs (IPAM-managed) for all instances"],"tags":["scaleway","ipam","network","api"],"backgroundTag":"api-permission-denied","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T07:17:12.445Z"}