kubernetes/kops · error

error listing ManagedInstances in %s: %w

Error message

error listing ManagedInstances in %s: %w

What it means

This error is returned by ListManagedInstances when InstanceGroupManagers().ListManagedInstances(ctx, project, zone, name) fails for any reason. kOps uses this to enumerate the VMs belonging to a managed instance group (e.g. to build/refresh instance lists). Unlike the delete helpers, there is no not-found short-circuit, so any API failure — including the MIG having just been deleted — is surfaced wrapped with the MIG name.

Source

Thrown at upup/pkg/fi/cloudup/gce/wrappers.go:123

}

// ListManagedInstances lists the specified InstanceGroupManagers in GCE
func ListManagedInstances(c GCECloud, igm *compute.InstanceGroupManager) ([]*compute.ManagedInstance, error) {
	ctx := context.Background()
	project := c.Project()

	zoneName := LastComponent(igm.Zone)

	// TODO: Only select a subset of fields
	//	req.Fields(
	//		googleapi.Field("items/selfLink"),
	//		googleapi.Field("items/metadata/items[key='cluster-name']"),
	//		googleapi.Field("items/metadata/items[key='instance-template']"),
	//	)

	instances, err := c.Compute().InstanceGroupManagers().ListManagedInstances(ctx, project, zoneName, igm.Name)
	if err != nil {
		return nil, fmt.Errorf("error listing ManagedInstances in %s: %w", igm.Name, err)
	}

	return instances, nil
}

View on GitHub (pinned to 4c8573c808)

Solutions

1. Check the wrapped googleapi error: 404 means the MIG no longer exists — treat as zero instances or re-list instance groups before proceeding
2. Verify the service account has compute.instanceGroupManagerViewer / compute.viewer roles
3. Re-fetch the InstanceGroupManager from the API rather than reusing a cached igm object to ensure zone/name are current
4. Confirm c.Project() matches the project the MIG belongs to
5. Retry on transient 5xx/timeouts with backoff

Example fix

// before: any failure aborts
instances, err := ListManagedInstances(cloud, igm)
if err != nil {
	return err
}
// after: tolerate a concurrently-deleted MIG
instances, err := ListManagedInstances(cloud, igm)
if err != nil {
	if isNotFound(err) {
		klog.Infof("MIG %s gone; skipping managed instances", igm.Name)
		instances = nil
	} else {
		return err
	}
}

// Verify the MIG still exists (and zone matches the client project) before listing instances
if _, err := cloud.Compute().InstanceGroupManagers().Get(cloud.Project(), lastComponent(igm.Zone), igm.Name).Do(); err != nil {
	if isNotFound(err) {
		return nil // MIG gone: no managed instances to list
	}
	return err
}

func migMissing(err error) bool {
	var gerr *googleapi.Error
	return errors.As(err, &gerr) && gerr.Code == 404
}

instances, err := gce.ListManagedInstances(cloud, igm)
if err != nil {
	var gerr *googleapi.Error
	if errors.As(err, &gerr) && gerr.Code == 404 {
		instances = nil // MIG deleted concurrently; nothing to list
	} else if errors.As(err, &gerr) && gerr.Code >= 500 {
		// transient; retry with backoff
	} else {
		return nil, err
	}
}

When it happens

Trigger: Calling listManagedInstances (instance refresh/validation paths) where the ListManagedInstances API call errors: the MIG was deleted concurrently, the igm.Zone/igm.Name no longer match an existing group, IAM denial, project mismatch between the cloud client and the igm object, or transient GCE API 5xx/timeout.

Common situations: kops rolling-update or validate running while a MIG is being resized/deleted elsewhere; igm struct built from a stale cloud group cache whose zone/name no longer exist; service account lacking compute.instanceGroupManagerViewer; cross-project confusion (client project != MIG's project); intermittent API failures on large lists.

Related errors

• error deleting InstanceGroupManager %s: %w
• error resizing InstanceGroupManager %s to 0: %w
• error deleting Instance %s: %w
• error listing Routes: %w
• error listing Addresses: %v

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/f2834100cd6ba2f0. Report an issue: GitHub.