What causes "error deleting group %q: %w" in kubernetes/kops?

Unwrap to find the failing instance ID and underlying Scaleway API error from the DeleteInstance chain.

error deleting group

Error message

error deleting group %q: %w

What it means

DeleteGroup iterates over all instances in a CloudInstanceGroup (NeedUpdate + Ready) and calls DeleteInstance on each. If any single instance deletion fails, the whole group deletion is aborted and wrapped as "error deleting group %q: %w" with the group's HumanName. It is a fan-out aggregator error — the root cause is always one of the per-instance DeleteInstance failures.

Solutions

Unwrap to find the failing instance ID and underlying Scaleway API error from the DeleteInstance chain.
Check the instance's state in the Scaleway console; manually delete or wait for a stuck server before retrying.
Verify the Scaleway credentials have permission to delete servers in that project/zone.
Re-run the kops rolling-update / delete command — DeleteInstance tolerates 404, so retries of already-deleted instances are safe.

Defensive patterns

Strategy: try-catch

Try / catch

if err := cloud.DeleteGroup(group); err != nil {
  var scwErr *scw.ResourceNotFoundError
  if errors.As(err, &scwErr) {
    klog.Warningf("instance in group %s already gone; safe to retry", group.HumanName)
  } else {
    klog.Errorf("group %s delete failed: %v — inspect per-instance errors", group.HumanName, err)
  }
  return err
}

Prevention

Check all group instances are in a deletable state before rolling updates.
Grant the Scaleway IAM policy servers:delete and servers:read scopes.
Avoid concurrent kops runs targeting the same instance group.
Retry idempotently — 404s on already-deleted instances are tolerated.

When it happens

Trigger: s.DeleteInstance fails for at least one instance in the group: the Scaleway instance API DeleteServer/GetServer call fails with a non-404 error (auth failure, instance in a state that cannot be deleted, network error, missing permission).

Common situations: Rolling-update of an instance group where one server is stuck deleting or in an error state; IAM credentials lacking instance deletion permission; a server already being deleted concurrently by another controller producing a conflict error.

Related errors

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/04586905da98ba40. Report an issue: GitHub.

Appendix: source

Thrown at upup/pkg/fi/cloudup/scaleway/cloud.go:227

func (s *scwCloudImplementation) IPAMService() *ipam.API {
	return s.ipamAPI
}

func (s *scwCloudImplementation) LBService() *lb.ZonedAPI {
	return s.lbAPI
}

func (s *scwCloudImplementation) MarketplaceService() *marketplace.API {
	return s.marketplaceAPI
}

func (s *scwCloudImplementation) DeleteGroup(group *cloudinstances.CloudInstanceGroup) error {
	toDelete := append(group.NeedUpdate, group.Ready...)
	for _, cloudInstance := range toDelete {
		err := s.DeleteInstance(cloudInstance)
		if err != nil {
			return fmt.Errorf("error deleting group %q: %w", group.HumanName, err)
		}
	}
	return nil
}

func (s *scwCloudImplementation) DeleteInstance(i *cloudinstances.CloudInstance) error {
	server, err := s.instanceAPI.GetServer(&instance.GetServerRequest{
		Zone:     s.zone,
		ServerID: i.ID,
	})
	if err != nil {
		if is404Error(err) {
			klog.V(4).Infof("error deleting cloud instance %s of group %s : instance was already deleted", i.ID, i.CloudInstanceGroup.HumanName)
			return nil
		}
		return fmt.Errorf("deleting cloud instance %s of group %s: %w", i.ID, i.CloudInstanceGroup.HumanName, err)
	}

View on GitHub (pinned to 4c8573c808)