What causes "error listing Akamai (Linode) VPCs: %w" in kubernetes/kops?

Verify the Linode API token is valid and has VPC read permissions.

error listing Akamai (Linode) VPCs: %w

Error message

error listing Akamai (Linode) VPCs: %w

What it means

findClusterVPCs in kOps' Akamai (Linode) code (used by listVPCs and listSubnets) wraps failures from linodego's ListVPCs API call. Without the VPC list, kOps cannot identify cluster-owned VPCs or subnets during discovery/deletion.

Source

Thrown at pkg/resources/linode/resources.go:175

		blocks = append(blocks, block)
	}
	sort.Strings(blocks)

	return blocks, nil
}

// findClusterVPCs finds Akamai (Linode) VPCs with the cluster's deterministic VPC label.
func findClusterVPCs(cloud fi.Cloud, clusterInfo resources.ClusterInfo) ([]linodego.VPC, error) {
	c := cloud.(cloudlinode.LinodeCloud)
	vpcLabel := cloudlinode.NormalizeLinodeLabel(clusterInfo.Name)
	listOptions, err := cloudlinode.ListOptionsForLabel(vpcLabel)
	if err != nil {
		return nil, err
	}

	vpcs, err := c.Client().ListVPCs(context.Background(), listOptions)
	if err != nil {
		return nil, fmt.Errorf("error listing Akamai (Linode) VPCs: %w", err)
	}

	region := c.Region()

	var clusterVPCs []linodego.VPC
	for _, vpc := range vpcs {
		if vpc.Label != vpcLabel {
			continue
		}
		if region != "" && vpc.Region != region {
			continue
		}

		clusterVPCs = append(clusterVPCs, vpc)
	}

	return clusterVPCs, nil
}

View on GitHub (pinned to 4c8573c808)

Solutions

Verify the Linode API token is valid and has VPC read permissions.
Ensure the linodego/kOps version supports the VPC endpoints (upgrade if the token/account has VPCs but the client is old).
Retry after any rate-limit window if the wrapped error is 429.
Confirm the same Linode account owns the VPCs (region/account check in `linode-cli vpcs list`).

Defensive patterns

Strategy: retry

Validate before calling

if os.Getenv("LINODE_TOKEN") == "" {
    return errors.New("LINODE_TOKEN is not set")
}
// and verify VPC scope: linode-cli vpcs list must succeed

Type guard

func isLinodeAuthOrNotFound(err error) bool {
    var le linodego.Error
    if !errors.As(err, &le) { return false }
    return le.Code == 401 || le.Code == 403 || le.Code == 404
}

Try / catch

vpcs, err := c.Client().ListVPCs(ctx, listOptions)
if err != nil {
    var le linodego.Error
    if errors.As(err, &le) && le.Code == 429 {
        return retryWithBackoff(err)
    }
    return fmt.Errorf("error listing Akamai (Linode) VPCs: %w", err)
}

Prevention

Use a current linodego/kOps build that supports the VPC API.
Verify VPC read permissions with `linode-cli vpcs list` before kOps operations.
Apply backoff on 429 responses.
Confirm the token's account owns the cluster's VPCs.

When it happens

Trigger: c.Client().ListVPCs(ctx, listOptions) errors: invalid token, token without VPC read scope, 429 rate limit, or Linode API/network failure.

Common situations: Pre-VPC API tokens or old linodego client versions lacking VPC support; rotated LINODE_TOKEN; region/account mismatch between the token and the cluster's VPCs.

Related errors

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/ea1e9f690f1863dc. Report an issue: GitHub.