kubernetes/kops · error

error listing InstanceGroupManagers: %v

Error message

error listing InstanceGroupManagers: %v

What it means

Returned by GetCloudGroups when listing managed instance groups (InstanceGroupManagers) in a zone fails via Compute().InstanceGroupManagers().List(). It wraps the underlying GCE API error so the caller knows the cloud-group inventory could not be built. This aborts operations that need the current cloud topology (rolling updates, cluster validation).

Source

Thrown at upup/pkg/fi/cloudup/gce/instancegroups.go:164

		templates, err := FindInstanceTemplates(c, cluster.Name)
		if err != nil {
			return nil, err
		}

		for _, t := range templates {
			instanceTemplates[t.SelfLink] = t
		}
	}

	zones, err := c.Zones()
	if err != nil {
		return nil, err
	}

	for _, zoneName := range zones {
		migs, err := c.Compute().InstanceGroupManagers().List(ctx, project, zoneName)
		if err != nil {
			return nil, fmt.Errorf("error listing InstanceGroupManagers: %v", err)
		}
		for _, mig := range migs {
			name := mig.Name

			instanceTemplate := instanceTemplates[mig.InstanceTemplate]
			if instanceTemplate == nil {
				klog.V(2).Infof("ignoring MIG %s with unmanaged InstanceTemplate: %s", name, mig.InstanceTemplate)
				continue
			}

			ig, err := matchInstanceGroup(mig, cluster, instancegroups)
			if err != nil {
				return nil, fmt.Errorf("error getting instance group for MIG %q", name)
			}
			if ig == nil {
				if warnUnmatched {
					klog.Warningf("Found MIG with no corresponding instance group %q", name)
				}

View on GitHub (pinned to 4c8573c808)

Solutions

1. Inspect the wrapped cause: 403 -> grant compute.instanceGroupManagers.list via roles/compute.viewer or instanceAdmin.
2. Verify the zone names resolved for the cluster actually exist in the project (gcloud compute zones list).
3. Retry on 429/5xx rate-limit or transient errors; reduce concurrent calls for large multi-zone clusters.
4. Confirm GOOGLE_APPLICATION_CREDENTIALS / default credentials are valid and not expired.

Example fix

// before
return nil, fmt.Errorf("error listing InstanceGroupManagers: %v", err)
// after (skip unavailable zones only if acceptable, else fail)
if gerr, ok := err.(*googleapi.Error); ok && gerr.Code == 403 {
    return nil, fmt.Errorf("missing compute.instanceGroupManagers.list IAM permission in zone %s: %v", zoneName, err)
}
return nil, fmt.Errorf("error listing InstanceGroupManagers: %v", err)

// pre-flight checks before invoking GetCloudGroups-dependent commands
ctx := context.Background()
_, err := computeService.InstanceGroupManagers.List(project, zone).Context(ctx).Do()
if err != nil {
    log.Fatalf("cannot list MIGs in %s: %v", zone, err) // fix IAM/quota first
}

func isGoogleAPIErr(err error, code int) bool {
    var gerr *googleapi.Error
    return errors.As(err, &gerr) && gerr.Code == code
}

migs, err := c.Compute().InstanceGroupManagers().List(ctx, project, zone)
if err != nil {
    if isGoogleAPIErr(err, 429) || isGoogleAPIErr(err, 500) {
        time.Sleep(backoff)
        migs, err = c.Compute().InstanceGroupManagers().List(ctx, project, zone)
    }
    if err != nil {
        return nil, fmt.Errorf("error listing InstanceGroupManagers: %v", err)
    }
}

When it happens

Trigger: Calling GetCloudGroups where InstanceGroupManagers().List(ctx, project, zoneName) returns any error for one of the cluster's zones: IAM permission denied (compute.instanceGroupManagers.list), invalid zone, API quota exhaustion/rate limiting, or network/API outage.

Common situations: Running `kops get clusters`/rolling-update against GCP with a misconfigured service account, a region/zone change after cluster creation, GCE API rate limiting in large clusters, or transient Google API outages.

Related errors

• error recreating Instance %s: %v
• error getting instance group for MIG %q
• error getting Instance: %v
• found multiple instance groups matching MIG %q
• instance group %q must specify exactly one zone

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/0cda98392ee569f6. Report an issue: GitHub.