kubernetes/kops · error

error listing Instances

Error message

error listing Instances: %v

What it means

In the GCE Instance task's Find, kOps fetches the instance with Instances().Get. If the call fails with anything other than a NotFound, the error is wrapped as 'error listing Instances'. It means the instance lookup itself failed at the GCE API level, not that the instance is absent.

Solutions

1. Read the wrapped %v error to identify the underlying GCE API failure
2. Verify the zone in the instance spec/state exists: `gcloud compute zones list`
3. Enable the Compute Engine API and check IAM: service account needs compute.viewer (compute.instances.get)
4. Retry if the error is transient (429/5xx)

// Verify the zone and API access before the Get call
cmd := exec.Command("gcloud", "compute", "instances", "describe", *e.Name,
	"--zone", *e.Zone, "--project", cloud.Project(), "--format=value(name)")
if err := cmd.Run(); err != nil {
	return fmt.Errorf("precheck: instance %s not accessible in zone %s: %w", *e.Name, *e.Zone, err)
}

func isNotFound(err error) bool { return err != nil && gce.IsNotFound(err) }
func isPermissionDenied(err error) bool {
	var ge *googleapi.Error
	return errors.As(err, &ge) && ge.Code == 403
}

r, err := cloud.Compute().Instances().Get(cloud.Project(), *e.Zone, *e.Name)
if err != nil {
	if gce.IsNotFound(err) { return nil, nil }
	var ge *googleapi.Error
	if errors.As(err, &ge) && (ge.Code == 429 || ge.Code >= 500) {
		return nil, retry.Wrapf(err, "transient; retry with backoff")
	}
	return nil, fmt.Errorf("error listing Instances: %v", err)
}

When it happens

Trigger: Instances().Get(project, zone, name) returns a non-NotFound error: invalid/unknown zone, permission denied on the compute API, API disabled, network failure, or quota/billing issues.

Common situations: Zone removed or mis-set in the state vs. current project, Compute Engine API disabled for the project, service account lacking compute.instances.get IAM permission, or transient API outages during `kops update cluster --refresh`.

Related errors

• error creating FirewallRule
• error creating ForwardingRule
• error creating Router
• error creating ServiceAccount
• error deleting Akamai (Linode) instance

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/2a01f13b2a097b43. Report an issue: GitHub.

Appendix: source

Thrown at upup/pkg/fi/cloudup/gcetasks/instance.go:74

	metadataFingerprint string
}

var _ fi.CompareWithID = (*Instance)(nil)

func (e *Instance) CompareWithID() *string {
	return e.Name
}

func (e *Instance) Find(c *fi.CloudupContext) (*Instance, error) {
	cloud := c.T.Cloud.(gce.GCECloud)

	r, err := cloud.Compute().Instances().Get(cloud.Project(), *e.Zone, *e.Name)
	if err != nil {
		if gce.IsNotFound(err) {
			return nil, nil
		}
		return nil, fmt.Errorf("error listing Instances: %v", err)
	}

	actual := &Instance{}
	actual.Name = &r.Name
	actual.Tags = append(actual.Tags, r.Tags.Items...)
	actual.Zone = new(lastComponent(r.Zone))
	actual.MachineType = new(lastComponent(r.MachineType))
	actual.CanIPForward = &r.CanIpForward
	if r.Scheduling != nil {
		actual.Preemptible = &r.Scheduling.Preemptible
	}
	if len(r.NetworkInterfaces) != 0 {
		ni := r.NetworkInterfaces[0]
		actual.Network = &Network{Name: new(lastComponent(ni.Network))}
		actual.StackType = &ni.StackType
		if len(ni.AccessConfigs) != 0 {
			ac := ni.AccessConfigs[0]
			if ac.NatIP != "" {

View on GitHub (pinned to 4c8573c808)