kubernetes/kops · error

error querying for address %q: %v

Error message

error querying for address %q: %v

What it means

While reconstructing the actual state of a GCE instance, kOps finds the instance's external NAT IP and queries static Addresses with a filter (address eq <NatIP>) to map the IP back to a static address resource. This error is thrown when that Addresses().ListWithFilter call fails.

Source

Thrown at upup/pkg/fi/cloudup/gcetasks/instance.go:95

	actual := &Instance{}
	actual.Name = &r.Name
	actual.Tags = append(actual.Tags, r.Tags.Items...)
	actual.Zone = new(lastComponent(r.Zone))
	actual.MachineType = new(lastComponent(r.MachineType))
	actual.CanIPForward = &r.CanIpForward
	if r.Scheduling != nil {
		actual.Preemptible = &r.Scheduling.Preemptible
	}
	if len(r.NetworkInterfaces) != 0 {
		ni := r.NetworkInterfaces[0]
		actual.Network = &Network{Name: new(lastComponent(ni.Network))}
		actual.StackType = &ni.StackType
		if len(ni.AccessConfigs) != 0 {
			ac := ni.AccessConfigs[0]
			if ac.NatIP != "" {
				addrs, err := cloud.Compute().Addresses().ListWithFilter(cloud.Project(), cloud.Region(), "address eq "+ac.NatIP)
				if err != nil {
					return nil, fmt.Errorf("error querying for address %q: %v", ac.NatIP, err)
				} else if len(addrs) != 0 {
					actual.IPAddress = &Address{Name: &addrs[0].Name}
				} else {
					return nil, fmt.Errorf("address not found %q: %v", ac.NatIP, err)
				}
			}
		}
	}

	for _, serviceAccount := range r.ServiceAccounts {
		for _, scope := range serviceAccount.Scopes {
			actual.Scopes = append(actual.Scopes, scopeToShortForm(scope))
		}
	}

	actual.Disks = make(map[string]*Disk)
	for i, disk := range r.Disks {
		if i == 0 {

View on GitHub (pinned to 4c8573c808)

Solutions

1. Inspect the wrapped %v error for the underlying API cause
2. Verify the region: `gcloud compute addresses list --filter="address=<NatIP>"` in the same region as the instance
3. Grant the kops service account compute.addresses.list permission (compute.networkViewer or compute.viewer)
4. Retry if transient

// Pre-check that the address filter query is serviceable
resp, err := computeSvc.Addresses.List(project, region).Filter("address eq "+natIP).Do()
if err != nil {
	var ge *googleapi.Error
	if errors.As(err, &ge) && ge.Code == 403 { /* fix IAM before proceeding */ }
	return err
}

func isGoogleAPIErr(err error, code int) bool {
	var ge *googleapi.Error
	return errors.As(err, &ge) && ge.Code == code
}

addrs, err := cloud.Compute().Addresses().ListWithFilter(cloud.Project(), cloud.Region(), "address eq "+ac.NatIP)
if err != nil {
	if isGoogleAPIErr(err, 429) || isGoogleAPIErr(err, 500) {
		return nil, retry.WithBackoff(err) // transient
	}
	return nil, fmt.Errorf("error querying for address %q: %v", ac.NatIP, err)
}

When it happens

Trigger: Addresses().ListWithFilter(project, region, "address eq "+ac.NatIP) returns an error — bad region, IAM permission denied on compute.addresses.list, API disabled, or transient API failure — while the instance has an AccessConfig with a NatIP.

Common situations: Region mismatch between instance and reserved addresses, service account lacking compute.addresses.list permission, Compute Engine API partially enabled, or network interruption during kops update cluster.

Related errors

• error finding Address with IP=%q: %w
• error finding Address %q: %v
• error fetching GCE instance: %w
• error fetching GCE instance group template %q: %v
• error fetching GCE managed instance group %q: %v

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/de8859235c49ed2d. Report an issue: GitHub.