kubernetes/kops · error

getting API ingress status

Error message

getting API ingress status

What it means

After listing NICs, kOps collects private IP addresses of primary IP configurations into ingresses. If the resulting list is empty (ingresses == nil), it returns this generic error. It means the control plane VMSS exists and its NICs were listed, but no primary private IP configuration yielded an address, so an API ingress status cannot be reported.

Source

Thrown at upup/pkg/fi/cloudup/azure/azure_cloud.go:358

		nis, err := c.NetworkInterface().ListScaleSetsNetworkInterfaces(context.TODO(), rg, vmssName)
		if err != nil {
			return nil, fmt.Errorf("getting control plane VMSS network interfaces for API ingress status: %w", err)
		}
		for _, ni := range nis {
			if ni.Properties == nil || ni.Properties.Primary == nil || !*ni.Properties.Primary {
				continue
			}
			for _, i := range ni.Properties.IPConfigurations {
				if i.Properties == nil || i.Properties.PrivateIPAddress == nil {
					continue
				}
				ingresses = append(ingresses, fi.ApiIngressStatus{
					IP: *i.Properties.PrivateIPAddress,
				})
			}
		}
		if ingresses == nil {
			return nil, fmt.Errorf("getting API ingress status")
		}
	}

	return ingresses, nil
}

func (c *azureCloudImplementation) SubscriptionID() string {
	return c.subscriptionID
}

func (c *azureCloudImplementation) ResourceGroup() ResourceGroupsClient {
	return c.resourceGroupsClient
}

func (c *azureCloudImplementation) VirtualNetwork() VirtualNetworksClient {
	return c.vnetsClient
}

View on GitHub (pinned to 4c8573c808)

Solutions

  1. Check control plane instance NICs in Azure (az vmss nic list -g <rg> --vmss-name <vmssName>) and verify each has a primary IP configuration with a private IP.
  2. Wait for in-flight rolling updates/scale operations to finish, then retry.
  3. If instances are unhealthy, recreate them via `kops rolling-update cluster` or kOps update to restore expected networking.
  4. Verify the load balancer backend pool and NIC wiring were not manually altered; restore via `kops update cluster --yes`.
  5. Run kops validate cluster to get a fuller health picture of the control plane.

Example fix

null
Defensive patterns

Strategy: validation

Validate before calling

// Go: check primary NIC IP configurations exist before expecting ingress output
nicPager := nicClient.NewListVirtualMachineScaleSetNetworkInterfacesPager(rg, vmssName, nil)
hasPrimaryIP := false
for nicPager.More() {
    page, _ := nicPager.NextPage(ctx)
    for _, ni := range page.Value {
        for _, ipc := range ni.Properties.IPConfigurations {
            if ipc.Properties != nil && ipc.Properties.PrivateIPAddress != nil {
                hasPrimaryIP = true
            }
        }
    }
}
if !hasPrimaryIP { return fmt.Errorf("no private IPs on control plane VMSS %s", vmssName) }

Type guard

func hasPrivateIP(ni *armnetwork.Interface) bool {
    if ni == nil || ni.Properties == nil {
        return false
    }
    for _, ipc := range ni.Properties.IPConfigurations {
        if ipc.Properties != nil && ipc.Properties.PrivateIPAddress != nil {
            return true
        }
    }
    return false
}

Try / catch

status, err := cloud.GetApiIngressStatus(cluster)
if err != nil && err.Error() == "getting API ingress status" {
    log.Printf("no primary private IPs found on control plane NICs; inspect VMSS instances and IP configs")
    return err
}

Prevention

When it happens

Trigger: GetApiIngressStatus finds the control plane VMSS and lists NICs, but no NIC has Properties.Primary == true, no NIC has IPConfigurations, or PrivateIPAddress is nil/unset on all configurations.

Common situations: NICs were deleted or detached from control plane VMSS instances; VMSS instances failed provisioning so IP configurations were never assigned; manual edits to the NIC/IP configuration in the Azure portal; a VMSS scale-in removed all instances momentarily during rolling updates.

Related errors

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/7ca2f51e877eed2f. Report an issue: GitHub.