What causes "getting VMSS VM: %w" in kubernetes/kops?

Check the wrapped error: 404 means the scale-set instance is gone — delete the stale Node object (kubectl delete node )

getting VMSS VM: %w

Error message

getting VMSS VM: %w

What it means

When the parsed providerID identifies a scale-set instance (Microsoft.Compute/virtualMachineScaleSets/virtualMachines), getVMTags calls the VMSS VMs client Get API to fetch the instance and its tags. Failure of that API call is wrapped with 'getting VMSS VM'.

Source

Thrown at pkg/nodeidentity/azure/client.go:90

		return nil, fmt.Errorf("unknown providerID : %s", providerID)
	}

	res, err := arm.ParseResourceID(strings.TrimPrefix(providerID, "azure://"))
	if err != nil {
		return nil, fmt.Errorf("error parsing providerID: %v", err)
	}

	switch res.ResourceType.String() {
	case "Microsoft.Compute/virtualMachines":
		resp, err := c.vmClient.Get(ctx, res.ResourceGroupName, res.Name, nil)
		if err != nil {
			return nil, fmt.Errorf("getting VM: %w", err)
		}
		return resp.VirtualMachine.Tags, nil
	case "Microsoft.Compute/virtualMachineScaleSets/virtualMachines":
		resp, err := c.vmssClient.Get(ctx, res.ResourceGroupName, res.Parent.Name, res.Name, nil)
		if err != nil {
			return nil, fmt.Errorf("getting VMSS VM: %w", err)
		}
		return resp.VirtualMachineScaleSetVM.Tags, nil
	default:
		return nil, fmt.Errorf("unsupported resource type %q for %q", res.ResourceType, providerID)
	}
}

View on GitHub (pinned to 4c8573c808)

Solutions

Check the wrapped error: 404 means the scale-set instance is gone — delete the stale Node object (kubectl delete node <name>)
Verify the VMSS and instance exist: az vmss list-instances -g <rg> -n <vmss-name>
Ensure the identity has Reader role on the VMSS resource group
Retry on transient (5xx/429) errors; verify the parent scale-set name segment in the providerID is correct

Defensive patterns

Strategy: retry

Validate before calling

// verify the VMSS instance exists before the call
az vmss list-instances -g <resource-group> -n <scale-set-name> --query "[].instanceId" -o tsv

Try / catch

resp, err := c.vmssClient.Get(ctx, rg, vmssName, instanceID, nil)
if err != nil {
    var respErr *azcore.ResponseError
    if errors.As(err, &respErr) && respErr.StatusCode == 404 {
        // instance scaled in; delete stale Node object
    } else if respErr != nil && (respErr.StatusCode == 429 || respErr.StatusCode >= 500) {
        // transient: retry with backoff
    }
    return fmt.Errorf("getting VMSS VM: %w", err)
}

Prevention

Expect 404s from autoscaling scale-ins and treat them as node removal, not failure
Grant the identity Reader on the VMSS resource group
Retry 429/5xx with exponential backoff
Keep VMSS names in providerIDs consistent across cluster upgrades

When it happens

Trigger: c.vmssClient.Get(ctx, resourceGroup, scaleSetName, instanceID, nil) returns an error — instance no longer exists (scaled in / deallocated), wrong parent scale-set name in the providerID, RBAC denial, or API/network failure.

Common situations: Node object from an instance that was scaled in by autoscaling; VMSS renamed or recreated; managed identity missing Reader on the resource group; stale providerID after cluster upgrade.

Related errors

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/28f6b1821b94ac0e. Report an issue: GitHub.