kubernetes/kops · error

listing back-ends for load-balancer %s: %w

Error message

listing back-ends for load-balancer %s: %w

What it means

During LBBackend.Find, kOps lists back-ends of the Scaleway Load Balancer filtered by name to locate the existing backend matching this task. This error wraps a failure of lb.ZonedAPI.ListBackends. It is thrown whenever the LB API listing call itself fails (auth, zone/LBID invalid, network) — note a zero or multiple matches does NOT error (returns nil), only the API call failing does.

Source

Thrown at upup/pkg/fi/cloudup/scalewaytasks/lb_backend.go:83

func (l *LBBackend) CompareWithID() *string {
	return l.ID
}

func (l *LBBackend) Find(context *fi.CloudupContext) (*LBBackend, error) {
	cloud := context.T.Cloud.(scaleway.ScwCloud)
	lbService := cloud.LBService()

	if l.LoadBalancer.LBID == nil {
		return nil, nil
	}

	backendResponse, err := lbService.ListBackends(&lb.ZonedAPIListBackendsRequest{
		Zone: scw.Zone(cloud.Zone()),
		LBID: fi.ValueOf(l.LoadBalancer.LBID),
		Name: l.Name,
	})
	if err != nil {
		return nil, fmt.Errorf("listing back-ends for load-balancer %s: %w", fi.ValueOf(l.LoadBalancer.LBID), err)
	}
	if backendResponse.TotalCount != 1 {
		return nil, nil
	}
	backend := backendResponse.Backends[0]

	return &LBBackend{
		Name:                 new(backend.Name),
		Lifecycle:            l.Lifecycle,
		ID:                   new(backend.ID),
		Zone:                 new(string(backend.LB.Zone)),
		ForwardProtocol:      new(string(backend.ForwardProtocol)),
		ForwardPort:          new(backend.ForwardPort),
		ForwardPortAlgorithm: new(string(backend.ForwardPortAlgorithm)),
		StickySessions:       new(string(backend.StickySessions)),
		ProxyProtocol:        new(string(backend.ProxyProtocol)),
		LoadBalancer: &LoadBalancer{
			Name: new(backend.LB.Name),

View on GitHub (pinned to 4c8573c808)

Solutions

1. Verify the LB exists and matches: `scw lb lb list` and compare the LBID stored in cluster state.
2. Check the zone used (cloud.Zone()) matches the load-balancer's zone (`scw lb lb get <id>`).
3. Re-authenticate: verify SCW_ACCESS_KEY/SCW_SECRET_KEY and that the key has LB read permissions (Container/LB Manager policy).
4. If the LB was deleted out-of-band, run `kops update cluster` to recreate it (Find returning the listing error first must pass once credentials/LB are fixed).
5. Retry on transient 5xx; check Scaleway status page.

Example fix

// ensure LBID nil-check and zone correctness before listing
if l.LoadBalancer.LBID == nil {
    return nil, nil
}
backendResponse, err := lbService.ListBackends(&lb.ZonedAPIListBackendsRequest{
    Zone: scw.Zone(cloud.Zone()), // must equal the LB's zone, not the cluster default
    LBID: fi.ValueOf(l.LoadBalancer.LBID),
    Name: l.Name,
})

// pre-flight: confirm the LB exists and is reachable in the expected zone
lbs, err := lbService.ListLBs(&lb.ZonedAPIListLBsRequest{Zone: scw.Zone(cloud.Zone()), Name: &lbName})
if err != nil || len(lbs.LBs) == 0 {
    return fmt.Errorf("load-balancer %s not found in zone %s: %w", lbName, zone, err)
}

func isScwNotFoundOrDenied(err error) (notFound, denied bool) {
    var respErr *scw.ResponseError
    if !errors.As(err, &respErr) { return false, false }
    return respErr.StatusCode == http.StatusNotFound, respErr.StatusCode == http.StatusForbidden
}

backendResponse, err := lbService.ListBackends(req)
if err != nil {
    var respErr *scw.ResponseError
    if errors.As(err, &respErr) && respErr.StatusCode == 404 {
        return nil, nil // LB gone; let RenderScw recreate it
    }
    return nil, fmt.Errorf("listing back-ends for load-balancer %s: %w", fi.ValueOf(l.LoadBalancer.LBID), err)
}

When it happens

Trigger: lbService.ListBackends(&lb.ZonedAPIListBackendsRequest{Zone, LBID, Name}) returns an error: invalid or deleted LBID (lb deleted out-of-band), wrong zone vs. the LB's actual zone, expired/insufficient SCW credentials, 403 permission-denied on the LB resource, or network/API outage.

Common situations: Load balancer was deleted manually in the Scaleway console while cluster state still references it; cluster.spec region/zone changed so the LB ID no longer matches; IAM policy change removed lb read permission from the kOps service account; SCW API outage during `kops update cluster`.

Related errors

• failed to retrieve droplet %d: %w
• failed to get server %s: %w
• failed to list load balancers: %w
• failed to get info for load balancer %q: %w
• deregistering cloud instance %s of group %q: %w

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/5deac9a32f46b505. Report an issue: GitHub.