kubernetes/kops · error

Failed to list L3 floating ip: %v

Error message

Failed to list L3 floating ip: %v

What it means

findL3Floating in upup/pkg/fi/cloudup/openstacktasks/floatingip.go:61 wraps any error from cloud.ListL3FloatingIPs (Neutron l3 floatingip list) while retrying with readBackoff. It indicates the Neutron Networking API list call failed, not that no floating IP was found (an empty list just retries until timeout). The raw gophercloud/Neutron error is embedded in %v.

Source

Thrown at upup/pkg/fi/cloudup/openstacktasks/floatingip.go:61

	WellKnownServices []wellknownservices.WellKnownService
}

var _ fi.HasAddress = (*FloatingIP)(nil)

var readBackoff = wait.Backoff{
	Duration: time.Second,
	Factor:   1.5,
	Jitter:   0.1,
	Steps:    10,
}

// this function tries to find l3 floating, and retries x times to find that. In some cases the floatingip is not in place in first request
func findL3Floating(cloud openstack.OpenstackCloud, opts l3floatingip.ListOpts) ([]l3floatingip.FloatingIP, error) {
	var result []l3floatingip.FloatingIP
	done, err := vfs.RetryWithBackoff(readBackoff, func() (bool, error) {
		fips, err := cloud.ListL3FloatingIPs(opts)
		if err != nil {
			return false, fmt.Errorf("Failed to list L3 floating ip: %v", err)
		}
		if len(fips) == 0 {
			return false, nil
		}
		result = fips
		return true, nil
	})
	if !done {
		if err == nil {
			err = wait.ErrWaitTimeout
		}
		return result, err
	}
	return result, nil
}

// GetWellKnownServices implements fi.HasAddress::GetWellKnownServices.
// It indicates which services we support with this address.

View on GitHub (pinned to 4c8573c808)

Solutions

1. Read the wrapped error: for 401 re-authenticate (`kops export kubecfg --admin` won't help; refresh OS_* credentials) and rerun.
2. For 403, grant the project/user the Networking service listing rights or use the correct project scope.
3. Verify the Neutron public endpoint is reachable (`openstack floating ip list`) and catalog entries are correct.
4. If it's a transient Neutron 5xx, simply rerun the kops command once the service recovers.

// sanity-check Neutron reachability before invoking the task
_, err := cloud.ListL3FloatingIPs(l3floatingip.ListOpts{Limit: 1})
if err != nil {
    return fmt.Errorf("neutron unreachable: %w", err)
}

func isAuthError(err error) bool {
    var gerr gophercloud.ErrUnexpectedResponseCode
    return errors.As(err, &gerr) && (gerr.Actual == 401 || gerr.Actual == 403)
}

fips, err := findL3Floating(cloud, opts)
if err != nil {
    if isAuthError(err) {
        // re-authenticate / fix credentials, then retry once
    }
    return fmt.Errorf("floating ip lookup aborted: %w", err)
}

When it happens

Trigger: Neutron returns 401/403 (bad token or no access to the project's networks), 404 if the networking endpoint/extension is missing, or 5xx/timeouts — retried across ~10 backoff steps then surfaced.

Common situations: Expired Keystone tokens during a long `kops update cluster`; missing networking service endpoint in the catalog; Neutron outage or API rate limiting; user lacking rights to list floating IPs in the external network's project.

Related errors

• failed to list layer 3 floating ips: %v
• could not establish floating network id
• GetApiIngressStatus: Failed to list floating IP's: %v
• error listing networks: %v
• did not find floatingsubnet for external router

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/35e6a6c4acd7531b. Report an issue: GitHub.