What causes "error getting ingress status: %v" in kubernetes/kops?

Read the wrapped cause to identify whether it is auth, throttling, or not-found.

error getting ingress status: %v

Error message

error getting ingress status: %v

What it means

GetWellKnownAddresses queries the cloud load balancer for the API ingress status via cloud.GetApiIngressStatus(fullCluster). If that cloud API call fails, the error is wrapped as 'error getting ingress status: %v'. It indicates the load-balancer/ingress object backing the kube-apiserver could not be described.

Source

Thrown at pkg/commands/toolbox_enroll.go:728

		return *b.wellKnownAddresses, nil
	}

	cloud, err := b.GetCloud(ctx)
	if err != nil {
		return nil, err
	}

	fullCluster, err := b.GetFullCluster(ctx)
	if err != nil {
		return nil, err
	}

	// Determine the well-known addresses for the cluster.
	wellKnownAddresses := make(model.WellKnownAddresses)
	{
		ingresses, err := cloud.GetApiIngressStatus(fullCluster)
		if err != nil {
			return nil, fmt.Errorf("error getting ingress status: %v", err)
		}

		for _, ingress := range ingresses {
			// TODO: Do we need to support hostnames?
			// if ingress.Hostname != "" {
			// 	apiserverAdditionalIPs = append(apiserverAdditionalIPs, ingress.Hostname)
			// }
			if ingress.IP != "" {
				wellKnownAddresses[wellknownservices.KubeAPIServer] = append(wellKnownAddresses[wellknownservices.KubeAPIServer], ingress.IP)
			}
		}
	}
	if len(wellKnownAddresses[wellknownservices.KubeAPIServer]) == 0 {
		// TODO: Should we support DNS?
		return nil, fmt.Errorf("unable to determine IP address for kube-apiserver")
	}
	for k := range wellKnownAddresses {
		sort.Strings(wellKnownAddresses[k])

View on GitHub (pinned to 4c8573c808)

Solutions

Read the wrapped cause to identify whether it is auth, throttling, or not-found.
Confirm the API load balancer exists in the cloud console / `kops get cluster -oyaml` (spec.api.loadBalancer).
Re-check cloud credentials and IAM permissions for describing load balancers.
Wait for LB provisioning to finish and retry; add backoff for throttling errors.

Example fix

// before
wellKnownAddresses built directly after one call, no retry
// after
ingresses, err := cloud.GetApiIngressStatus(fullCluster)
if err != nil {
	// retry with backoff for transient API/throttling errors before failing
	return nil, fmt.Errorf("error getting ingress status: %v", err)
}

Defensive patterns

Strategy: retry

Validate before calling

// Confirm the API load balancer is described by the cloud SDK before building addresses
// e.g. aws elbv2 describe-load-balancers --names <apiserver-lb>

Try / catch

if err != nil {
	var throttle *ThrottlingError
	if errors.As(err, &throttle) {
		time.Sleep(backoff) // then retry GetApiIngressStatus
	}
	return fmt.Errorf("error getting ingress status: %v", err)
}

Prevention

Wait for kops validate cluster to pass before enrolling
Ensure IAM permissions include load-balancer describe/read
Add exponential backoff for cloud API calls

When it happens

Trigger: GetBootstrapData -> GetWellKnownAddresses calling GetApiIngressStatus when the cloud LB API errors: LB not yet provisioned, throttling, auth failure, or the loadBalancer object is absent from the cluster spec.

Common situations: Newly created cluster where the API load balancer is still provisioning; IAM/credentials lacking elb/loadBalancer read permissions; cloud API outage or rate limiting; running from a network that cannot reach the cloud endpoint.

Related errors

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/7f7f9ed2a833ccef. Report an issue: GitHub.