What causes "failed to list listeners: %v" in kubernetes/kops?

failed to list listeners: %v

Error message

failed to list listeners: %v

What it means

Listing Octavia listeners failed at the API level while fetching all pages. Persistence beyond the built-in retry backoff points to endpoint, credential, or service issues.

Source

Thrown at upup/pkg/fi/cloudup/openstack/loadbalancer.go:526

		}
		return poolList, err
	}
	return poolList, nil
}

func (c *openstackCloud) ListListeners(opts listeners.ListOpts) (listenerList []listeners.Listener, err error) {
	return listListeners(c, opts)
}

func listListeners(c OpenstackCloud, opts listeners.ListOpts) (listenerList []listeners.Listener, err error) {
	if c.LoadBalancerClient() == nil {
		return listenerList, fmt.Errorf("loadbalancer support not available in this deployment")
	}

	done, err := vfs.RetryWithBackoff(readBackoff, func() (bool, error) {
		listenerPage, err := listeners.List(c.LoadBalancerClient(), opts).AllPages(context.TODO())
		if err != nil {
			return false, fmt.Errorf("failed to list listeners: %v", err)
		}
		listenerList, err = listeners.ExtractListeners(listenerPage)
		if err != nil {
			return false, fmt.Errorf("failed to extract listeners: %v", err)
		}
		return true, nil
	})
	if !done {
		if err == nil {
			err = wait.ErrWaitTimeout
		}
		return listenerList, err
	}
	return listenerList, nil
}

func (c *openstackCloud) CreateListener(opts listeners.CreateOpts) (listener *listeners.Listener, err error) {
	return createListener(c, opts)

View on GitHub (pinned to 4c8573c808)

Example fix

null

Defensive patterns

Strategy: retry

Validate before calling

listeners, err := cloud.ListListeners(listeners.ListOpts{})
_ = err // pre-flight smoke check at controller start

Try / catch

ll, err := cloud.ListListeners(opts)
if err != nil {
	if strings.Contains(err.Error(), "400") {
		// ListOpts field unsupported by this Octavia version; retry with reduced opts
	}
	return fmt.Errorf("listing listeners: %w", err)
}

Prevention

Only pass ListOpts fields your Octavia version supports
Re-authenticate on 401 before failing the reconcile loop
Smoke-test listener listing at controller startup

When it happens

Trigger: listeners.List(c.LoadBalancerClient(), opts).AllPages(context.TODO()) returns an error: invalid token, project lacks lbaas access, listener filter matches nothing but API errors (e.g. bad ListOpts fields), or Octavia endpoint unreachable.

Common situations: ListOpts containing fields unsupported by the deployed Octavia version (400); expired auth mid-reconcile; Octavia returning 503 during rolling upgrade; MTU/network issues to the API endpoint.

Related errors

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/9ebff10e8e7b6b5b. Report an issue: GitHub.