kubernetes/kops · error

listing disks: %w

Error message

listing disks: %w

What it means

DisksClient.List pages through all disks in a resource group via NewListByResourceGroupPager. ResourceGroupNotFound is explicitly treated as an empty list, but any other pager failure is wrapped as "listing disks: %w". This is a read-path error: the caller (typically cluster teardown/fuzzing code looking for orphaned disks) cannot enumerate existing disks.

Source

Thrown at upup/pkg/fi/cloudup/azure/disk.go:68

	}
	return &resp.Disk, err
}

func (c *disksClientImpl) List(ctx context.Context, resourceGroupName string) ([]*compute.Disk, error) {
	if resourceGroupName == "" {
		return nil, nil
	}

	var l []*compute.Disk
	pager := c.c.NewListByResourceGroupPager(resourceGroupName, nil)
	for pager.More() {
		resp, err := pager.NextPage(ctx)
		if err != nil {
			var respErr *azcore.ResponseError
			if errors.As(err, &respErr) && respErr.ErrorCode == "ResourceGroupNotFound" {
				return nil, nil
			}
			return nil, fmt.Errorf("listing disks: %w", err)
		}
		l = append(l, resp.Value...)
	}
	return l, nil
}

func (c *disksClientImpl) Delete(ctx context.Context, resourceGroupName, diskName string) error {
	future, err := c.c.BeginDelete(ctx, resourceGroupName, diskName, nil)
	if err != nil {
		return fmt.Errorf("deleting disk: %w", err)
	}
	if _, err := future.PollUntilDone(ctx, nil); err != nil {
		return fmt.Errorf("waiting for disk deletion completion: %w", err)
	}
	return nil
}

func newDisksClientImpl(subscriptionID string, cred *azidentity.DefaultAzureCredential) (*disksClientImpl, error) {

View on GitHub (pinned to 4c8573c808)

Solutions

1. Unwrap and check *azcore.ResponseError: 401 means re-authenticate (az login, refresh SP secret, fix managed identity); 403 means grant Microsoft.Compute/disks/read on the resource group.
2. Verify AZURE_TENANT_ID / AZURE_SUBSCRIPTION_ID / client credentials are set and correct in the environment or azure-cloud-provider config.
3. Confirm the resource group name is correct and exists in the configured subscription.
4. For transient network/429 errors, retry the List with exponential backoff.

Example fix

// caller-side handling
if _, err := disks.List(ctx, rg); err != nil {
    var respErr *azcore.ResponseError
    if errors.As(err, &respErr) && respErr.StatusCode == 403 {
        klog.Warningf("missing disks/read permission on %s: %v", rg, err)
    }
}

if resourceGroupName == "" {
    return nil, nil // matches the client's own empty-rg behavior
}
cred, err := azidentity.NewDefaultAzureCredential(nil)
if err != nil {
    return fmt.Errorf("no Azure credentials available: %w", err)
}

func isAuthError(err error) bool {
    var respErr *azcore.ResponseError
    return errors.As(err, &respErr) && (respErr.StatusCode == 401 || respErr.StatusCode == 403)
}

if err != nil {
    var respErr *azcore.ResponseError
    if errors.As(err, &respErr) {
        switch {
        case respErr.ErrorCode == "ResourceGroupNotFound":
            return nil // treat as empty, like the client does
        case respErr.StatusCode == 401 || respErr.StatusCode == 403:
            return fmt.Errorf("credentials/permissions insufficient for listing disks: %w", err)
        default:
            return retryableOrWrap(err)
        }
    }
}

When it happens

Trigger: Calling DisksClient.List when a paging NextPage call fails for reasons other than ResourceGroupNotFound: invalid/missing credentials (401), RBAC missing Microsoft.Compute/disks/read (403), invalid subscription ID, network failure, or ARM throttling during pagination.

Common situations: Running kOps with an Azure identity lacking Reader on the resource group; an expired az login/SP secret; wrong AZURE_SUBSCRIPTION_ID env var; transient network outage during a multi-page listing; tenant/subscription misconfiguration in the cloud config.

Related errors

• creating/updating disk: %w
• waiting for disk create/update completion: %w
• deleting disk: %w
• listing public ip addresses: %w
• listing resource groups: %w

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/97d079d9cdc1058b. Report an issue: GitHub.