GetApiIngressStatus: Failed to list control plane nodes: %v

Error message

GetApiIngressStatus: Failed to list control plane nodes: %v

What it means

Error returned from getIPIngressStatus when listing all Nova instances fails while searching for control-plane (master) nodes to derive the API ingress address from instance addresses. Wrapped by vfs.RetryWithBackoff so the underlying call is retried before surfacing.

Source

Thrown at upup/pkg/fi/cloudup/openstack/cloud.go:806

			return ingresses, fmt.Errorf("GetApiIngressStatus: Failed to list floating IP's: %v", err)
		}
		for _, fip := range fips {
			if fip.PortID == lb.VipPortID {
				ingresses = append(ingresses, fi.ApiIngressStatus{
					IP: fip.FloatingIP,
				})
			}
		}
	}

	return ingresses, nil
}

func getIPIngressStatus(c OpenstackCloud, cluster *kops.Cluster) (ingresses []fi.ApiIngressStatus, err error) {
	done, err := vfs.RetryWithBackoff(readBackoff, func() (bool, error) {
		instances, err := c.ListInstances(servers.ListOpts{})
		if err != nil {
			return false, fmt.Errorf("GetApiIngressStatus: Failed to list control plane nodes: %v", err)
		}
		for _, instance := range instances {
			val, ok := instance.Metadata["k8s"]
			val2, ok2 := instance.Metadata["KopsRole"]
			if ok && val == cluster.Name && ok2 {
				role, success := kops.ParseInstanceGroupRole(val2, false)
				if success && role.HasControlPlane() {
					ifName := instance.Metadata[TagKopsNetwork]
					address, err := GetServerFixedIP(&instance, ifName)
					if err == nil {
						ingresses = append(ingresses, fi.ApiIngressStatus{
							IP: address,
						})
					} else {
						ips, err := c.ListServerFloatingIPs(instance.ID)
						if err != nil {
							return false, err
						}

View on GitHub (pinned to 4c8573c808)

Solutions

Check Nova API: `openstack server list` with the same credentials
Re-authenticate / refresh OS_* environment credentials
Verify the compute endpoint is registered in the Keystone catalog
Retry — this path is wrapped in RetryWithBackoff, so transient faults often self-heal

Defensive patterns

Strategy: retry

Validate before calling

// preflight
if _, err := novaClient.Get(novaClient.ServiceURL("servers", "detail"), nil); err != nil {
    return fmt.Errorf("nova API unreachable: %v", err)
}

Try / catch

done, err := vfs.RetryWithBackoff(readBackoff, func() (bool, error) {
    instances, err := c.ListInstances(servers.ListOpts{})
    if err != nil { return false, fmt.Errorf("GetApiIngressStatus: Failed to list control plane nodes: %v", err) }
    return true, nil
})

Prevention

Rely on the existing RetryWithBackoff and avoid escalating on first failure
Keep OS_* credentials valid for validation commands
Verify compute endpoint registration in the cloud config

When it happens

Trigger: c.ListInstances(servers.ListOpts{}) errors inside the retry closure: Nova compute API unreachable, auth failure, or endpoint misconfiguration.

Common situations: Nova outage during `kops get cluster`/validation; expired OpenStack token; compute endpoint absent from catalog in a stripped-down cloud config; network partition to the Nova API.

Related errors

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/d79514bd16ffc16b. Report an issue: GitHub.