kubernetes/kops · error
deleting resource group: %w
Error message
deleting resource group: %w
What it means
Wraps the immediate failure of resources.ResourceGroupsClient.BeginDelete, the call that starts asynchronous deletion of a resource group. This is the request-rejection stage; a later poll failure produces the separate 'waiting for resource group deletion completion' error.
Source
Thrown at upup/pkg/fi/cloudup/azure/resourcegroup.go:61
}
func (c *resourceGroupsClientImpl) List(ctx context.Context) ([]*resources.ResourceGroup, error) {
var l []*resources.ResourceGroup
pager := c.c.NewListPager(nil)
for pager.More() {
resp, err := pager.NextPage(ctx)
if err != nil {
return nil, fmt.Errorf("listing resource groups: %w", err)
}
l = append(l, resp.Value...)
}
return l, nil
}
func (c *resourceGroupsClientImpl) Delete(ctx context.Context, name string) error {
future, err := c.c.BeginDelete(ctx, name, nil)
if err != nil {
return fmt.Errorf("deleting resource group: %w", err)
}
if _, err = future.PollUntilDone(ctx, nil); err != nil {
return fmt.Errorf("waiting for resource group deletion completion: %w", err)
}
return nil
}
func newResourceGroupsClientImpl(subscriptionID string, cred *azidentity.DefaultAzureCredential) (*resourceGroupsClientImpl, error) {
c, err := resources.NewResourceGroupsClient(subscriptionID, cred, nil)
if err != nil {
return nil, fmt.Errorf("creating resource group client: %w", err)
}
return &resourceGroupsClientImpl{
c: c,
}, nil
}
View on GitHub (pinned to 4c8573c808)
Solutions
- Check the wrapped ResponseError: ResourceGroupNotFound means deletion already done — treat as success
- Remove any Azure management locks (ReadOnly/CanNotDelete) on the resource group
- Ensure the identity has the delete permission (Contributor or Owner at subscription/group scope)
- Confirm the resource group name matches the kOps cluster's cluster-name-based group
Defensive patterns
Strategy: type-guard
Validate before calling
az lock list -g $RG -o table # no ReadOnly/CanNotDelete locks az group show -n $RG -o none # group exists and identity can access it
Type guard
func isNotFoundOrAlreadyGone(err error) bool {
var re *azcore.ResponseError
if !errors.As(err, &re) { return false }
return re.StatusCode == 404 || re.ErrorCode == "ResourceGroupNotFound"
} Try / catch
err := rgClient.Delete(ctx, name)
var re *azcore.ResponseError
if errors.As(err, &re) {
if re.StatusCode == 404 { return nil /* already deleted; idempotent */ }
if re.ErrorCode == "RequestDisallowedByPolicy" || strings.Contains(re.ErrorCode, "ScopeLock") {
return fmt.Errorf("remove management lock before deleting group %s", name)
}
} Prevention
- Check for Azure management locks before teardown
- Make delete paths idempotent by swallowing 404
- Grant Contributor/Owner to the automation identity
- Delete clusters once at a time to avoid double-teardown races
When it happens
Trigger: resourceGroupsClientImpl.Delete(ctx, name) where BeginDelete fails: resource group already gone (ResourceGroupNotFound), RBAC denies Microsoft.Resources/subscriptions/resourceGroups/delete, or the group is locked (ReadOnly/CanNotDelete management lock).
Common situations: Re-running cluster deletion after a partial teardown (group already deleted); a subscription-level management lock left from an earlier maintenance window; insufficient Contributor role.
Related errors
- deleting public ip address: %w
- listing resource groups: %w
- deleting VMSS: %w
- DeleteGroup not implemented on azureCloud
- deleting disk: %w
AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05).
Data as JSON: /api/errors/9a88503bd7af23b1.
Report an issue: GitHub.