kubernetes/kops · error

connecting: %w

Error message

connecting: %w

What it means

This is the wrapper error returned by logDumper.dumpNode (pkg/dump/dumper.go:311) when the initial SSH connection to a cluster node fails during a log dump. dumpNode enforces a per-node timeout (default 1 minute, --node-dump-timeout) and delegates to connectToNode, which calls sshClientFactory.Dial. Any Dial failure — TCP refused, timeout, auth rejection, missing bastion — is wrapped here with %w so the underlying cause is preserved and can be unwrapped with errors.Is/As.

Source

Thrown at pkg/dump/dumper.go:311

// Large clusters dump multi-GB logs per node and need a higher value, configurable
// via the --node-dump-timeout flag, because the files are dumped sequentially and a
// single oversized log can otherwise exhaust the budget before the rest are read.
const defaultNodeDumpTimeout = time.Minute

// DumpNode connects to a node and dumps the logs.
func (d *logDumper) dumpNode(ctx context.Context, name string, ip string, useBastion bool) error {
	if ip == "" {
		return fmt.Errorf("could not find address for %v, ", name)
	}

	klog.Infof("Dumping node %s", name)

	ctx, cancel := context.WithTimeout(ctx, d.nodeDumpTimeout)
	defer cancel()

	n, err := d.connectToNode(ctx, name, ip, useBastion)
	if err != nil {
		return fmt.Errorf("connecting: %w", err)
	}

	// As long as we connect to the node we will not return an error;
	// a failure to collect a log (or even any logs at all) is not
	// considered an error in dumping the node.
	// TODO(justinsb): clean up / rationalize
	errors := n.dump(ctx)
	for _, e := range errors {
		klog.Warningf("error dumping node %s: %v", name, e)
	}

	if err := n.Close(); err != nil {
		klog.Warningf("error closing connection: %v", err)
	}

	return nil
}

View on GitHub (pinned to 4c8573c808)

Solutions

1. Read the wrapped cause (%w) with errors.Unwrap or by printing the full error; fix the underlying SSH failure (refused/unreachable/auth) first.
2. Verify network reachability: security groups/firewall allow SSH (22) from your host or via the bastion, and the node IP passed to dumpNode is current (nodes may have been replaced).
3. Confirm bastion configuration: useBastion=true requires HasBastion(); either configure a bastion or pass the public address so useBastion=false.
4. Check SSH credentials: the cluster SSH key exists locally and the username matches the node image (e.g. ubuntu/admin/ec2-user).
5. Increase --node-dump-timeout if the error wraps 'context deadline exceeded' for large clusters.

Example fix

// before
n, err := d.connectToNode(ctx, name, ip, useBastion)
if err != nil {
    return fmt.Errorf("connecting: %w", err)
}
// after (caller-side: inspect wrapped cause)
n, err := d.connectToNode(ctx, name, ip, useBastion)
if err != nil {
    var ctxErr context.Context
    if errors.As(err, &ctxErr) || errors.Is(err, context.DeadlineExceeded) {
        return fmt.Errorf("connecting to %s: timed out after %s; raise --node-dump-timeout: %w", name, d.nodeDumpTimeout, err)
    }
    return fmt.Errorf("connecting to %s: %w", name, err)
}

// pre-check before dumping
conn, err := net.DialTimeout("tcp", ip+":22", 5*time.Second)
if err != nil {
    return fmt.Errorf("node %s unreachable on :22, skipping dump: %w", name, err)
}
conn.Close()
if useBastion && !d.sshClientFactory.HasBastion() {
    useBastion = false
}

err := dumper.dumpNode(ctx, name, ip, useBastion)
if err != nil {
    if errors.Is(err, context.DeadlineExceeded) {
        klog.Warningf("dump timed out for %s; raise --node-dump-timeout", name)
    } else if !errors.Is(err, context.Canceled) {
        klog.Warningf("skipping node %s: %v", name, err)
    }
}

When it happens

Trigger: dumpNode calls d.connectToNode(ctx, name, ip, useBastion) and the sshClientFactory.Dial call returns any error: connection refused, context deadline exceeded (nodeDumpTimeout hit), host unreachable, SSH handshake/auth failure, or Dial with useBastion=true when HasBastion() is false.

Common situations: Running `kops get cluster --yes ... -oyaml` style dump/`kops toolbox dump` against a terminated or non-routable node IP; security group blocks port 22; node is a private node whose bastion was deleted; SSH key for the cluster not present or wrong user; --node-dump-timeout too small for slow/large clusters.

Related errors

• unable to SSH to %q: %v
• reading kops-channels manifest %s: %w
• error trying to locate asset %q: %v
• error downloading file %q: %v
• failed to get region from ec2 metadata: %w

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/257ec7596550654d. Report an issue: GitHub.