kubernetes/kops · error

error finding deletions: %w

Error message

error finding deletions: %w

What it means

After choosing a target, Run calls l.FindDeletions to discover resources that exist in the cloud but are no longer part of the cluster spec. If that discovery fails (typically an API error listing cloud resources), kops wraps the underlying error and aborts the apply so deletions are never silently skipped.

Source

Thrown at upup/pkg/fi/cloudup/apply_cluster.go:843

			out = io.Discard
			// For `kops get assets`,there is no need to run Find,
			// we are just trying to discover the assets.
			checkExisting = false
		}
		target = fi.NewCloudupDryRunTarget(assetBuilder, checkExisting, out)

		// Avoid making changes on a dry-run
		shouldPrecreateDNS = false

	default:
		return nil, fmt.Errorf("unsupported target type %q", c.TargetName)
	}
	c.Target = target

	if target.DefaultCheckExisting() {
		c.TaskMap, err = l.FindDeletions(cloud, c.LifecycleOverrides)
		if err != nil {
			return nil, fmt.Errorf("error finding deletions: %w", err)
		}
	}

	context, err := fi.NewCloudupContext(ctx, deletionProcessingMode, target, cluster, cloud, keyStore, secretStore, configBase, c.TaskMap)
	if err != nil {
		return nil, fmt.Errorf("error building context: %v", err)
	}

	var options fi.RunTasksOptions
	if c.RunTasksOptions != nil {
		options = *c.RunTasksOptions
	} else {
		options.InitDefaults()
	}

	err = context.RunTasks(options)
	if err != nil {
		return nil, fmt.Errorf("error running tasks: %v", err)

View on GitHub (pinned to 4c8573c808)

Solutions

1. Read the wrapped cause (%w) for the real cloud API error and fix that first — usually IAM/permissions or throttling
2. Retry after transient cloud API errors (rate limits, 5xx)
3. Compare the cluster spec against actual cloud state; remove references to resources that no longer exist
4. Use --target=terraform (deletions are handled by Terraform itself, DeletionProcessingModeIgnore) to bypass FindDeletions
5. Verify cloud credentials with e.g. `aws sts get-caller-identity` / equivalent for your provider

Example fix

// before: apply with a principal missing ec2:DescribeVpcs
kops update cluster mycluster.example.com
// after: grant list/describe permissions to the kops principal, then
kops update cluster mycluster.example.com

// preflight: verify credentials can list cloud resources
if err := cloud.ListAllResources(ctx); err != nil {
	return fmt.Errorf("FindDeletions would fail: %w", err)
}

err := cmd.Run(ctx)
if err != nil && strings.Contains(err.Error(), "error finding deletions") {
	// inspect wrapped cause: throttle (429), permission denied, or outage
	// back off and retry for transient codes
}

When it happens

Trigger: Any apply whose target returns DefaultCheckExisting()==true (direct and dryrun targets) where FindDeletions errors — e.g. cloud API throttling, permission failures listing resources, or a task's FindDeletions implementation returning an error.

Common situations: Cloud credentials lack list/describe permissions on some resource types; regional API outage or rate limiting; an unsupported or misconfigured resource in an existing cluster triggering an error inside a task's deletion discovery.

Related errors

• IP version is incorrect
• provider ID cannot be empty
• provider ID number cannot be empty
• incorrect syntax for lifecyle-overrides, correct syntax is T
• unknown lifecycle %q, available lifecycle: %s

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/5ea5c2c8eff8bd70. Report an issue: GitHub.