getting cluster control plane VMSS for API ingress status: %

Error message

getting cluster control plane VMSS for API ingress status: %w

What it means

kOps wraps the Azure SDK error returned while listing virtual machine scale sets in the cluster resource group when resolving the API (control plane) ingress status. If the List call on vmscaleSetsClient fails — due to auth, network, or an API error — the underlying error is wrapped with %w and returned to the caller of GetApiIngressStatus. It indicates kOps could not enumerate the control plane VMSS to find load balancer backends.

Source

Thrown at upup/pkg/fi/cloudup/azure/azure_cloud.go:323

					}
					for _, pip := range pips {
						if pip.ID == nil || pip.Properties == nil || pip.Properties.IPAddress == nil || *pip.ID != *i.Properties.PublicIPAddress.ID {
							continue
						}
						ingresses = append(ingresses, fi.ApiIngressStatus{
							IP: *pip.Properties.IPAddress,
						})
					}
				default:
					return nil, fmt.Errorf("unknown load balancer type: %q", lbSpec.Type)
				}
			}
		}
	} else {
		// Get scale sets in cluster resource group and find masters scale set
		scaleSets, err := c.vmscaleSetsClient.List(context.TODO(), rg)
		if err != nil {
			return nil, fmt.Errorf("getting cluster control plane VMSS for API ingress status: %w", err)
		}
		var vmssName string
		for _, scaleSet := range scaleSets {
			val, ok := scaleSet.Tags[TagClusterName]
			val2, ok2 := scaleSet.Tags[TagNameRolePrefix+TagRoleControlPlane]
			val3, ok3 := scaleSet.Tags[TagNameRolePrefix+TagRoleMaster]
			if ok && *val == cluster.Name && (ok2 && *val2 == "1" || ok3 && *val3 == "1") {
				vmssName = *scaleSet.Name
				break
			}
		}
		if vmssName == "" {
			return nil, fmt.Errorf("getting control plane VMSS name for API ingress status")
		}

		// Get masters scale set network interfaces and append to api ingress status
		nis, err := c.NetworkInterface().ListScaleSetsNetworkInterfaces(context.TODO(), rg, vmssName)
		if err != nil {

View on GitHub (pinned to 4c8573c808)

Solutions

Fix Azure credentials (az login, or verify the service principal used by kOps has Reader on the cluster resource group).
Retry the command; transient Azure API failures and throttling are a common cause.
Verify the cluster resource group exists and matches the cluster spec (az group show -g <rg>).
Check network/proxy connectivity from the machine running kOps to management.azure.com.
Inspect the wrapped cause (%w chain) for the specific Azure error code (e.g. AuthorizationFailed, ParentResourceNotFound).

Example fix

null

Defensive patterns

Strategy: try-catch

Validate before calling

// Go: verify credentials and resource group access before the call
cred, err := azidentity.NewDefaultAzureCredential(nil)
if err != nil { return err }
rgClient := armresources.NewResourceGroupsClient(subID, cred, nil)
if _, err := rgClient.Get(ctx, clusterResourceGroup, nil); err != nil {
    return fmt.Errorf("resource group %s not accessible: %w", clusterResourceGroup, err)
}

Type guard

func isAzureAuthErr(err error) bool {
    var respErr *azcore.ResponseError
    return errors.As(err, &respErr) && respErr.StatusCode == 401
}

Try / catch

status, err := cloud.GetApiIngressStatus(cluster)
if err != nil {
    if strings.Contains(err.Error(), "getting cluster control plane VMSS") {
        // inspect wrapped Azure cause, retry with backoff or fix credentials
        log.Printf("Azure API failure resolving ingress status: %v", err)
    }
    return err
}

Prevention

Keep Azure credentials fresh (az login / valid service principal) on the host running kOps.
Grant the principal Reader on the cluster resource group before operations.
Avoid bulk concurrent kOps invocations that could hit Azure throttling limits.
Verify the cluster resource group exists and matches the cluster name before running kOps commands.
Retain the full error chain (%w) when logging to see the Azure cause.

When it happens

Trigger: Calling cloud.GetApiIngressStatus() on an Azure cluster whose control plane runs as a VMSS, when vmscaleSetsClient.List(ctx, rg) fails for the cluster resource group (rg). This happens on Azure API errors: invalid/missing credentials, throttling (429), network failure, or a nonexistent/mismatched resource group.

Common situations: Expired or misconfigured Azure credentials (AZURE_CLIENT_ID/SECRET/TENANT); running `kops get clusters`/validate commands against a cluster whose resource group was renamed or deleted; Azure rate limiting during concurrent kOps operations; transient network failures to management.azure.com.

Related errors

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/9d8787a2f5b3f388. Report an issue: GitHub.