kubernetes/kops · error

getting cluster servers for load-balancer's back-end: %w

Error message

getting cluster servers for load-balancer's back-end: %w

What it means

kOps wraps failures from `scwCloud.GetClusterServers`, which lists the cluster's Scaleway instances used to compute back-end server IPs, when building the control-plane IP list for a load-balancer back-end. Thrown from getControlPlanesIPs, called by RenderScw of LoadBalancerBackend.

Source

Thrown at upup/pkg/fi/cloudup/scalewaytasks/lb_backend.go:248

		Name:            expected.Name,
		ForwardProtocol: expected.ForwardProtocol,
		ForwardPort:     expected.ForwardPort,
		ProxyProtocol:   new(strings.TrimPrefix(*expected.ProxyProtocol, "proxy_protocol_")),
		ServerIPs:       serverIPs,
	}
	return t.RenderResource("scaleway_lb_backend", fi.ValueOf(expected.Name), tf)
}

func (l *LBBackend) TerraformLink() *terraformWriter.Literal {
	return terraformWriter.LiteralProperty("scaleway_lb_backend", fi.ValueOf(l.Name), "id")
}

func getControlPlanesIPs(scwCloud scaleway.ScwCloud, lb *LoadBalancer, zone scw.Zone) ([]string, error) {
	var controlPlanePrivateIPs []string

	servers, err := scwCloud.GetClusterServers(scwCloud.ClusterName(lb.Tags), nil)
	if err != nil {
		return nil, fmt.Errorf("getting cluster servers for load-balancer's back-end: %w", err)
	}

	for _, server := range servers {
		if role := scaleway.InstanceRoleFromTags(server.Tags); role == scaleway.TagRoleWorker {
			continue
		}
		ip, err := scwCloud.GetServerIP(server.ID, server.Zone)
		if err != nil {
			return nil, fmt.Errorf("getting IP of server %s for load-balancer's back-end: %w", server.Name, err)
		}
		controlPlanePrivateIPs = append(controlPlanePrivateIPs, ip)
	}

	return controlPlanePrivateIPs, nil
}

View on GitHub (pinned to 4c8573c808)

Solutions

1. Rerun `kops update cluster` — usually a transient API failure
2. Verify Scaleway credentials (secret key, project ID) and that instances are visible in the console
3. Check that cluster-name tags on instances match the LB's tags configuration
4. Check Scaleway status page for Instance API incidents
5. Inspect the wrapped scw error for 4xx/5xx to distinguish auth vs server issues

Example fix

// before: single call, hard fail
servers, err := scwCloud.GetClusterServers(name, nil)
// after: retry transient errors
var servers []*instance.Server
for i := 0; i < 3; i++ {
    servers, err = scwCloud.GetClusterServers(name, nil)
    if err == nil { break }
    time.Sleep(5 * time.Second)
}

// verify credentials and cluster tag config before listing servers
if os.Getenv("SCW_SECRET_KEY") == "" { return errors.New("SCW_SECRET_KEY not set") }
if clusterName == "" { return errors.New("cluster name empty; cannot list cluster servers") }

var serr *scw.ResponseError
if errors.As(err, &serr) {
    if serr.Status == 403 { return fmt.Errorf("check Scaleway credentials/project: %w", err) }
    if serr.Status == 429 || serr.Status >= 500 { /* retry with backoff */ }
}

When it happens

Trigger: getControlPlanesIPs calls GetClusterServers(clusterName(lb.Tags), nil); the ListServers API call fails — bad credentials, wrong project/zone scope, API outage, or invalid cluster-name tags.

Common situations: Instance API credentials lacking list permission; cluster name tags missing/misconfigured so the lookup query is wrong; Scaleway API outage; instance deleted concurrently.

Related errors

• waiting for load-balancer: %w
• deleting load-balancer %s: %w
• updating back-end server IPs for load-balancer %s: %w
• creating back-end for load-balancer %s: %w
• getting IP of server %s for load-balancer's back-end: %w

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/d60c879c108f2597. Report an issue: GitHub.