kubernetes/kops · error

deleting role assignment: %w

Error message

deleting role assignment: %w

What it means

Wraps the synchronous failure of authz.RoleAssignmentsClient.Delete, which removes a role assignment at a scope by its role assignment name (a GUID). Failure means ARM rejected the delete request; the wrapped *azcore.ResponseError identifies the exact code.

Source

Thrown at upup/pkg/fi/cloudup/azure/roleassignment.go:69

}

func (c *roleAssignmentsClientImpl) List(ctx context.Context, scope string) ([]*authz.RoleAssignment, error) {
	var l []*authz.RoleAssignment
	pager := c.c.NewListForScopePager(scope, nil)
	for pager.More() {
		resp, err := pager.NextPage(ctx)
		if err != nil {
			return nil, fmt.Errorf("listing role assignments: %w", err)
		}
		l = append(l, resp.Value...)
	}
	return l, nil
}

func (c *roleAssignmentsClientImpl) Delete(ctx context.Context, scope, raName string) error {
	_, err := c.c.Delete(ctx, scope, raName, nil)
	if err != nil {
		return fmt.Errorf("deleting role assignment: %w", err)
	}
	return nil
}

func newRoleAssignmentsClientImpl(subscriptionID string, cred *azidentity.DefaultAzureCredential) (*roleAssignmentsClientImpl, error) {
	c, err := authz.NewRoleAssignmentsClient(subscriptionID, cred, nil)
	if err != nil {
		return nil, fmt.Errorf("creating role assignments client: %w", err)
	}
	return &roleAssignmentsClientImpl{
		c: c,
	}, nil
}

View on GitHub (pinned to 4c8573c808)

Solutions

1. If the wrapped error is RoleAssignmentNotFound, treat the assignment as already deleted and continue
2. Ensure the acting identity has Owner or User Access Administrator at the scope (Microsoft.Authorization/roleAssignments/delete)
3. Verify raName is the role assignment's GUID id segment and scope matches where the assignment was created
4. Retry after confirming the assignment still exists via List at the same scope

matched, _ := regexp.MatchString(`^[0-9a-fA-F-]{36}$`, raName)
if !matched || !validScope(scope) {
  return errors.New("azure: role assignment delete requires a GUID name and valid ARM scope")
}

func isRoleAssignmentNotFound(err error) bool {
  var re *azcore.ResponseError
  return errors.As(err, &re) && (re.StatusCode == 404 || re.ErrorCode == "RoleAssignmentNotFound")
}

err := raClient.Delete(ctx, scope, raName)
var re *azcore.ResponseError
if errors.As(err, &re) && re.StatusCode == 404 {
  return nil // already deleted; continue teardown
}
if err != nil {
  return fmt.Errorf("delete role assignment %s at %s: %w", raName, scope, err)
}

When it happens

Trigger: roleAssignmentsClientImpl.Delete(ctx, scope, raName) failing: assignment already deleted (RoleAssignmentNotFound / does not exist), raName not a valid GUID, RBAC denies Microsoft.Authorization/roleAssignments/delete (requires Owner or User Access Administrator), or scope mismatch.

Common situations: Double-delete during cluster teardown (assignment already removed); identity lacking User Access Administrator when cleaning up kOps-created role assignments; scope string drifted from the one used at creation.

Related errors

• listing role assignments: %w
• deleting VMSS: %w
• DeleteGroup not implemented on azureCloud
• updating Role Assignment is not yet implemented
• error deleting SSHCredential: %v

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/1b52817ebb0bcc80. Report an issue: GitHub.