{"record":{"id":"fea745465c643c2b","repo":"kubernetes/kops","slug":"describing-instance-for-arn-q","errorCode":null,"errorMessage":"describing instance for arn %q","messagePattern":"describing instance for arn %q","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/bootstrap/awsbootstrap/verifier.go","lineNumber":298,"sourceCode":"\t\treturn nil, fmt.Errorf(\"arn %q contains too few slashes\", arn)\n\t}\n\tfound := false\n\tfor _, role := range a.opt.NodesRoles {\n\t\tif resource[1] == role {\n\t\t\tfound = true\n\t\t\tbreak\n\t\t}\n\t}\n\tif !found {\n\t\treturn nil, fmt.Errorf(\"arn %q does not contain acceptable node role\", arn)\n\t}\n\n\tinstanceID := resource[2]\n\tinstances, err := a.ec2.DescribeInstances(ctx, &ec2.DescribeInstancesInput{\n\t\tInstanceIds: []string{instanceID},\n\t})\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"describing instance for arn %q\", arn)\n\t}\n\n\tif len(instances.Reservations) <= 0 || len(instances.Reservations[0].Instances) <= 0 {\n\t\treturn nil, fmt.Errorf(\"missing instance id: %s\", instanceID)\n\t}\n\tif len(instances.Reservations[0].Instances) > 1 {\n\t\treturn nil, fmt.Errorf(\"found multiple instances with instance id: %s\", instanceID)\n\t}\n\n\tinstance := instances.Reservations[0].Instances[0]\n\n\taddrs, err := GetInstanceCertificateNames(instances)\n\tif err != nil {\n\t\treturn nil, err\n\t}\n\n\tvar challengeEndpoints []string\n\tfor _, nic := range instance.NetworkInterfaces {","sourceCodeStart":280,"sourceCodeEnd":316,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/pkg/bootstrap/awsbootstrap/verifier.go#L280-L316","documentation":"Once the ARN passes validation, kOps extracts the EC2 instance ID from the session segment and calls ec2:DescribeInstances to find the instance. This error wraps any failure of that EC2 API call — it discards the underlying AWS error and only reports the ARN context.","triggerScenarios":"a.ec2.DescribeInstances returns an error: EC2 API outage/throttling (RequestLimitExceeded), credential permissions missing ec2:DescribeInstances on the verifier's role, network failure to the EC2 endpoint, invalid instance-ID format, or context cancellation.","commonSituations":"API server's IAM role missing the ec2:DescribeInstances permission after manual policy edits; EC2 API throttling during large cluster scale-ups; regional endpoint misconfiguration; transient AWS outages.","solutions":["Check the kOps controller/API server logs for the underlying AWS error; fix the specific cause (throttling, auth, endpoint).","Ensure the verifier's IAM policy includes ec2:DescribeInstances (kopsInstanceRole / kops-controller policy).","Retry the bootstrap request if the cause was transient throttling or an AWS outage; consider backoff on the node side.","Verify EC2 endpoint connectivity from the API server (VPC endpoints, DNS, proxy settings)."],"exampleFix":"// before: policy missing EC2 read\n// after: attach to the API-server/kops-controller role\n{ \"Effect\": \"Allow\", \"Action\": [\"ec2:DescribeInstances\"], \"Resource\": \"*\" }","handlingStrategy":"retry","validationCode":"// Pre-check the verifier's permissions before running nodes:\naws iam simulate-principal-policy --policy-source-arn <apiserver-role-arn> --action-names ec2:DescribeInstances","typeGuard":null,"tryCatchPattern":"instances, err := a.ec2.DescribeInstances(ctx, input)\nif err != nil {\n\tvar ae smithy.APIError\n\tif errors.As(err, &ae) && (ae.ErrorCode() == \"RequestLimitExceeded\" || ae.ErrorCode() == \"ThrottlingException\") {\n\t\t// retry with backoff\n\t}\n\treturn nil, fmt.Errorf(\"describing instance for arn %q: %w\", arn, err) // wrap, don't discard cause\n}","preventionTips":["Keep ec2:DescribeInstances in the API server/kops-controller IAM policy.","Implement exponential backoff for EC2 throttling errors during scale-up bursts.","Verify VPC endpoints/egress to the EC2 API from the API server subnet.","Wrap underlying AWS errors instead of dropping them to ease diagnosis."],"tags":["aws","ec2","api-error","network"],"backgroundTag":"aws-api-call-failed","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T07:17:12.445Z"}