kubernetes/kops · error

error creating instanceGroup: %v

Error message

error creating instanceGroup: %v

What it means

When the InstanceGroup did not exist (ig == nil) and --force allowed creation, `kops replace` calls clientset.InstanceGroupsFor(cluster).Create. This error wraps any failure returned by that Create call, meaning the new InstanceGroup resource could not be persisted to the state store.

Source

Thrown at cmd/kops/replace.go:189

				}
				// check if the instancegroup exists already
				igName := v.ObjectMeta.Name
				ig, err := clientset.InstanceGroupsFor(cluster).Get(ctx, igName, metav1.GetOptions{})
				if err != nil {
					if errors.IsNotFound(err) {
						if !c.Force {
							return fmt.Errorf("instanceGroup: %v does not exist (try adding --force flag)", igName)
						}
					} else {
						return fmt.Errorf("unable to check for instanceGroup: %v", err)
					}
				}
				switch ig {
				case nil:
					klog.Infof("instanceGroup: %v was not found, creating resource now", igName)
					_, err = clientset.InstanceGroupsFor(cluster).Create(ctx, v, metav1.CreateOptions{})
					if err != nil {
						return fmt.Errorf("error creating instanceGroup: %v", err)
					}
				default:
					_, err = clientset.InstanceGroupsFor(cluster).Update(ctx, v, metav1.UpdateOptions{})
					if err != nil {
						return fmt.Errorf("error replacing instanceGroup: %v", err)
					}
				}
			case *kopsapi.SSHCredential:
				clusterName := v.ObjectMeta.Labels[kopsapi.LabelClusterName]
				if clusterName == "" {
					return fmt.Errorf("must specify %q label with cluster name to replace SSHCredential", kopsapi.LabelClusterName)
				}
				if v.Spec.PublicKey == "" {
					return fmt.Errorf("spec.PublicKey is required")
				}

				cluster, err := clientset.GetCluster(ctx, clusterName)
				if err != nil {

View on GitHub (pinned to 4c8573c808)

Solutions

1. Read the wrapped error for the specific cause.
2. If it's a collision, re-run `kops replace -f ig.yaml` WITHOUT --force so the now-existing IG is updated instead of created.
3. Fix validation problems in the manifest (run `kops create -f ig.yaml --dry-run` to see errors).
4. Verify state-store write permissions and retry if transient.

Example fix

# before
kops replace -f ig.yaml --force   # Create collides after another process created it
# after
kops replace -f ig.yaml           # existing IG now goes through Update path

// Detect not-found and create via the documented path instead of --force
_, err := clientset.InstanceGroupsFor(cluster).Get(ctx, igName, metav1.GetOptions{})
createFirst := errors.IsNotFound(err)

if strings.HasPrefix(err.Error(), "error creating instanceGroup:") {
    // likely a concurrent create; fall back to update path
    time.Sleep(time.Second)
    return runReplaceWithoutForce()
}

When it happens

Trigger: Create fails after the existence check reported NotFound: concurrent creation by another operator/CI run, invalid IG spec rejected by validation, state-store write failure, or permission errors.

Common situations: Two pipelines running `kops replace --force` simultaneously (one creates first, the other's Create collides); manifest with invalid fields (bad machineType, missing subnets); state-store backend write errors.

Related errors

• unable to check for instanceGroup: %v
• did not find owner for node %q
• invalid InstanceGroup name: %v
• error building InstanceGroup from CAPI Machine: %w
• error loading NodeupConfig %q: %v

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/7f7958afd68e68fa. Report an issue: GitHub.