kubernetes/kops · error

error listing subnets: %v

Error message

error listing subnets: %v

What it means

listSubnets paginates through Neutron subnets via subnets.List(...).AllPages inside a RetryWithBackoff loop. If the Neutron API list call fails, the error is wrapped as "error listing subnets: %v". Retries are exhausted before surfacing, so the wrapped error reflects persistent API failure.

Source

Thrown at upup/pkg/fi/cloudup/openstack/subnet.go:39

	"fmt"

	"github.com/gophercloud/gophercloud/v2/openstack/networking/v2/subnets"
	"k8s.io/apimachinery/pkg/util/wait"
	"k8s.io/kops/upup/pkg/fi"
	"k8s.io/kops/util/pkg/vfs"
)

func (c *openstackCloud) ListSubnets(opt subnets.ListOptsBuilder) ([]subnets.Subnet, error) {
	return listSubnets(c, opt)
}

func listSubnets(c OpenstackCloud, opt subnets.ListOptsBuilder) ([]subnets.Subnet, error) {
	var s []subnets.Subnet

	done, err := vfs.RetryWithBackoff(readBackoff, func() (bool, error) {
		allPages, err := subnets.List(c.NetworkingClient(), opt).AllPages(context.TODO())
		if err != nil {
			return false, fmt.Errorf("error listing subnets: %v", err)
		}

		r, err := subnets.ExtractSubnets(allPages)
		if err != nil {
			return false, fmt.Errorf("error extracting subnets from pages: %v", err)
		}
		s = r
		return true, nil
	})
	if err != nil {
		return s, err
	} else if done {
		return s, nil
	} else {
		return s, wait.ErrWaitTimeout
	}
}

View on GitHub (pinned to 4c8573c808)

Solutions

1. Run `openstack subnet list` with the same credentials to reproduce the Neutron failure
2. Check the wrapped error: 401 => re-authenticate; 403 => fix RBAC policy; timeout => check Neutron service
3. Validate the network ID / filter options passed in ListOpts
4. Verify the networking service endpoint in the Keystone catalog

// Pre-flight: confirm neutron is reachable
if err := exec.Command("openstack", "subnet", "list", "--limit", "1").Run(); err != nil {
	log.Fatal("Neutron API unavailable")
}

subnets, err := listSubnets(cloud, opts)
if err != nil {
	if strings.Contains(err.Error(), "401") {
		// re-authenticate then retry once
	}
	return err
}

When it happens

Trigger: Neutron endpoint down/unreachable, auth failure on the networking client, invalid ListOpts filter (e.g. bad network ID or project ID), or quota/RBAC denial on subnet listing.

Common situations: Wrong OS_REGION_NAME or endpoint catalog entry, network ID typo in cluster config, Keystone token expired mid-operation, or a policy change restricting subnet reads for the project.

Related errors

• NewSubnetTaskFromCloud: Failed to get network with ID %s: %v
• error describing Network: %v
• network %q not found
• error listing subnets in network %q: %v
• error retrieving subnet with id %s: %v

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/7a1cdb73481bcd76. Report an issue: GitHub.