kubernetes/kops · error

failed to get IP for server %q: %w

Error message

failed to get IP for server %q: %w

What it means

After fetching the server, VerifyToken lists its IPv4 addresses via the IPAM API (ListIPs with WithAllPages). Any error from that paginated call is wrapped in this message and fails token verification.

Source

Thrown at upup/pkg/fi/cloudup/scaleway/verifier.go:109

	}

	serverResponse, err := instance.NewAPI(scwClient).GetServer(&instance.GetServerRequest{
		ServerID: serverID,
		Zone:     zone,
	}, scw.WithContext(ctx))
	if err != nil || serverResponse == nil || serverResponse.Server == nil {
		return nil, fmt.Errorf("failed to get server %s: %w", serverID, err)
	}
	server := serverResponse.Server

	ips, err := ipam.NewAPI(scwClient).ListIPs(&ipam.ListIPsRequest{
		Region:     region,
		ResourceID: new(server.ID),
		IsIPv6:     new(false),
		Zonal:      new(zone.String()),
	}, scw.WithContext(ctx), scw.WithAllPages())
	if err != nil {
		return nil, fmt.Errorf("failed to get IP for server %q: %w", server.Name, err)
	}
	if ips.TotalCount == 0 {
		return nil, fmt.Errorf("no IP found for server %q: %w", server.Name, err)
	}

	addresses := []string(nil)
	challengeEndPoints := []string(nil)
	for _, ip := range ips.IPs {
		addresses = append(addresses, ip.Address.IP.String())
		challengeEndPoints = append(challengeEndPoints, net.JoinHostPort(ip.Address.IP.String(), strconv.Itoa(wellknownports.NodeupChallenge)))
	}

	result := &bootstrap.VerifyResult{
		NodeName:          server.Name,
		InstanceGroupName: InstanceGroupNameFromTags(server.Tags),
		CertificateNames:  addresses,
		ChallengeEndpoint: challengeEndPoints[0],
	}

View on GitHub (pinned to 4c8573c808)

Solutions

1. Grant the control-plane IAM policy IPAM read permission (ipam_ips:list) in the Scaleway console
2. Verify the IPAM API returns the IP manually: scw ipam ip list project-id=<id> resource-id=<server-id>
3. Retry the bootstrap after a transient API failure/rate limit

// preflight: check IPAM list permission by listing IPs for the project
ips, err := ipam.NewAPI(scwClient).ListIPs(&ipam.ListIPsRequest{ProjectID: &projectID}, scw.WithContext(ctx))
if err != nil {
	var rerr *scw.ResponseError
	if errors.As(err, &rerr) && rerr.StatusCode == 403 {
		log.Fatal("missing IPAM read permission on control-plane credentials")
	}
}

func isPermissionDenied(err error) bool {
	var rerr *scw.ResponseError
	return errors.As(err, &rerr) && rerr.StatusCode == 403
}

if err != nil {
	var rerr *scw.ResponseError
	if errors.As(err, &rerr) && (rerr.StatusCode == 429 || rerr.StatusCode >= 500) {
		// transient: retry with backoff
	}
	return fmt.Errorf("failed to get IP for server %q: %w", server.Name, err)
}

When it happens

Trigger: ipam.ListIPs returns an error — typically an IAM permission problem on the IPAM API, an invalid region/zone scoping (region derived from zone is wrong for the resource), or a transient Scaleway API failure.

Common situations: The control-plane Scaleway credentials lack IPAM read permission (post-2023 IPAM is mandatory for flexible IPs), the server has no private IPAM entry because it was created outside IPAM, or an API outage/rate limit.

Related errors

• listing IPs for server %s: %w
• no IP found for server %q: %w
• failed to retrieve droplet %d: %w
• failed to get server %s: %w
• failed to list vpcs: %v

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/f8731e3cc40bce06. Report an issue: GitHub.