kubernetes/kops · error

error listing IP Addresses: %v

Error message

error listing IP Addresses: %v

What it means

findAddressByIP wraps an error returned by the GCE Compute API when listing static IP addresses with the filter "address eq <ip>". Any non-HTTP-200 response from Addresses().ListWithFilter — auth failures, quota issues, API outages, malformed requests — is surfaced with this message. It propagates up to the Find method of the Address task, failing the refresh/reconcile phase.

Source

Thrown at upup/pkg/fi/cloudup/gcetasks/address.go:71

func (e *Address) Find(c *fi.CloudupContext) (*Address, error) {
	actual, err := e.find(c.T.Cloud.(gce.GCECloud))
	if actual != nil && err == nil {
		if e.IPAddress == nil {
			e.IPAddress = actual.IPAddress
		}

		// Ignore system fields
		actual.Lifecycle = e.Lifecycle
		actual.WellKnownServices = e.WellKnownServices
	}
	return actual, err
}

func findAddressByIP(cloud gce.GCECloud, ip string, subnet string) (*Address, error) {
	// Technically this is a regex, but it doesn't matter, it's a prefilter
	addrs, err := cloud.Compute().Addresses().ListWithFilter(cloud.Project(), cloud.Region(), "address eq "+ip)
	if err != nil {
		return nil, fmt.Errorf("error listing IP Addresses: %v", err)
	}

	var matches []*compute.Address
	for _, addr := range addrs {
		if subnet != "" && addr.Subnetwork != subnet {
			continue
		}
		if addr.Address == ip {
			matches = append(matches, addr)
		}
	}

	if len(matches) == 0 {
		return nil, nil
	}

	if len(matches) > 1 {
		return nil, fmt.Errorf("found multiple Addresses matching %q", ip)

View on GitHub (pinned to 4c8573c808)

Solutions

1. Inspect the wrapped %v cause; if it's a 403/permission error, grant the service account roles/compute.networkAdmin (or compute.viewer at minimum).
2. Verify the Compute Engine API is enabled: `gcloud services enable compute.googleapis.com --project=<project>`.
3. Re-authenticate: `gcloud auth application-default login` or fix GOOGLE_APPLICATION_CREDENTIALS / the credential chain kops uses.
4. For 429/5xx causes, retry the `kops update cluster` run after the transient condition clears.
5. If the IP value came from the spec, confirm it is a well-formed address string so the eq filter is valid.

out, err := exec.Command("gcloud", "services", "list", "--project", project, "--filter", "name:compute.googleapis.com").CombinedOutput()
if err != nil || !strings.Contains(string(out), "compute.googleapis.com") {
    return fmt.Errorf("compute API not enabled/accessible for project %s", project)
}

if err := runKopsUpdate(); err != nil {
    if strings.Contains(err.Error(), "error listing IP Addresses") {
        // inspect wrapped cause: check credentials, compute API enabled, retry on 429/5xx
        if isRateLimit(err) { time.Sleep(backoff); retry() }
    }
}

When it happens

Trigger: Addresses().ListWithFilter(project, region, "address eq "+ip) returns err != nil during findAddressByIP (called from Find): expired credentials, API disabled (compute.googleapis.com), transient 5xx/429 responses, or an unparseable/invalid filter value for the IP string.

Common situations: GCP credentials revoked or service account lacking compute.addresses.list permission, compute API disabled on the project, GCE regional outage or rate limiting, or running kops against a project/region whose API endpoint errors.

Related errors

• found multiple Addresses matching %q
• error listing zones: %v
• expected exactly one subnet with GCE IP Aliases
• address not found %q: %v
• error creating Router: %w

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/b20ae41e9d553ce9. Report an issue: GitHub.