kubernetes/kops · error

error getting ingress status: %v

Error message

error getting ingress status: %v

What it means

findSystemEndpoints queries the cloud provider (via cloudup.BuildCloud + cloud.GetApiIngressStatus) for the load-balancer ingress addresses that expose kops-controller and the kube-apiserver. This error wraps any failure returned by the cloud lookup itself, meaning kops could not ask the cloud API (or the cloud replied with an error) about the API ingress status. It aborts building the KopsControlPlane status, since system endpoints are required for bootstrap data generation.

Source

Thrown at pkg/controllers/clusterapi/cluster_controller.go:185

func (s *clusterScope) findSystemEndpoints(ctx context.Context) ([]capikops.SystemEndpoint, error) {
	cluster := s.Cluster

	clusterInternal := &kops.Cluster{}
	if err := kopscodecs.Scheme.Convert(cluster, clusterInternal, nil); err != nil {
		return nil, fmt.Errorf("converting cluster object: %w", err)
	}

	cloud, err := cloudup.BuildCloud(clusterInternal)
	if err != nil {
		return nil, err
	}

	// TODO: Sync with BuildKubecfg

	ingresses, err := cloud.GetApiIngressStatus(clusterInternal)
	if err != nil {
		return nil, fmt.Errorf("error getting ingress status: %v", err)
	}

	var targets []capikops.SystemEndpoint

	for _, ingress := range ingresses {
		var target capikops.SystemEndpoint
		if ingress.Hostname != "" {
			target.Endpoint = ingress.Hostname
		}
		if ingress.IP != "" {
			target.Endpoint = ingress.IP
		}
		target.Type = capikops.SystemEndpointTypeKopsController
		if ingress.InternalEndpoint {
			target.Scope = capikops.SystemEndpointScopeInternal
		} else {
			target.Scope = capikops.SystemEndpointScopeExternal
		}

View on GitHub (pinned to 4c8573c808)

Solutions

1. Verify the controller has valid cloud credentials (service account / IAM role) and network access to the cloud API
2. Check that the API load balancer for the cluster exists and is healthy in the cloud console
3. Inspect the wrapped inner error (%v) to identify whether it is auth, networking, or NotFound
4. Re-run reconcile after the load balancer finishes provisioning; the controller will retry

Example fix

// before
ingresses, err := cloud.GetApiIngressStatus(clusterInternal)
if err != nil {
    return nil, fmt.Errorf("error getting ingress status: %v", err)
}
// after: tolerate not-yet-ready LBs and retry instead of failing hard
ingresses, err := cloud.GetApiIngressStatus(clusterInternal)
if err != nil {
    if apierrors.IsNotFound(err) || isTransientCloudError(err) {
        return nil, ctrl.Result{RequeueAfter: 30 * time.Second}, nil // retry when LB is ready
    }
    return nil, fmt.Errorf("error getting ingress status: %v", err)
}

// before relying on reconcile, confirm cloud reachability
cloud, err := cloudup.BuildCloud(clusterInternal)
if err != nil { return err }
if _, err := cloud.GetApiIngressStatus(clusterInternal); err != nil {
    klog.Warningf("ingress status not yet available, will retry: %v", err)
}

// caller side (controller):
endpoints, err := s.findSystemEndpoints(ctx)
if err != nil {
    klog.Warningf("endpoints lookup failed, requeueing: %v", err)
    return ctrl.Result{RequeueAfter: 30 * time.Second}, nil
}

When it happens

Trigger: cloud.GetApiIngressStatus returns an error: cloud API credentials missing/invalid, network outage from the controller to the cloud API, load balancer not yet provisioned so the provider returns NotFound, or the cluster spec lacks required fields (region/project) needed by BuildCloud (though those have separate errors).

Common situations: Running the clusterapi controller on GCP/AWS before the API load balancer exists; expired IAM/service-account credentials; controller pod without network egress to cloud APIs; cloud SDK quota or throttling errors during bursty reconciles.

Related errors

• error getting ingress status: %v
• did not find API endpoint
• instance group %q has %d zones, which is not yet supported f
• unhandled LoadBalancer type %q
• error getting ForwardingRule %q: %w

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/6931d127ea3518ef. Report an issue: GitHub.