kubernetes/kops · error

listing nodes in cluster: %v

Error message

listing nodes in cluster: %v

What it means

getNodes returns this when the List call against the CoreV1 Nodes API fails — i.e. the kubernetes API could not be reached or rejected the request. This is the k8s-API connectivity check performed before any instance deletion, and the error wraps the client-go failure (connection refused, timeout, TLS, auth).

Source

Thrown at cmd/kops/delete_instance.go:285

		if err != nil {
			return fmt.Errorf("cannot create cluster validator: %v", err)
		}
	}
	d.ClusterValidator = clusterValidator

	return d.UpdateSingleInstance(ctx, cloudMember, options.Surge)
}

func getNodes(ctx context.Context, kubeClient kubernetes.Interface, verbose bool) ([]v1.Node, error) {
	var nodes []v1.Node

	nodeList, err := kubeClient.CoreV1().Nodes().List(ctx, metav1.ListOptions{})
	if err != nil {
		if verbose {
			fmt.Fprintf(os.Stderr, "Unable to reach the kubernetes API.\n")
			fmt.Fprintf(os.Stderr, "Use --cloudonly to do a deletion without confirming progress with the k8s API\n\n")
		}
		return nil, fmt.Errorf("listing nodes in cluster: %v", err)
	}

	if nodeList != nil {
		nodes = nodeList.Items
	}
	return nodes, nil
}

func deleteNodeMatch(cloudMember *cloudinstances.CloudInstance, options *DeleteInstanceOptions) bool {
	return cloudMember.ID == options.InstanceID ||
		(!options.CloudOnly && cloudMember.Node != nil && cloudMember.Node.Name == options.InstanceID)
}

func findDeletionNode(groups map[string]*cloudinstances.CloudInstanceGroup, options *DeleteInstanceOptions) *cloudinstances.CloudInstance {
	for _, group := range groups {
		for _, r := range group.Ready {
			if deleteNodeMatch(r, options) {
				return r

View on GitHub (pinned to 4c8573c808)

Solutions

1. If the instance cannot reach the API anyway, re-run with --cloudonly to skip the k8s API entirely (the CLI itself prints this hint).
2. Test connectivity: `kubectl --kubeconfig <kubecfg> get nodes` — fix DNS/firewall/security-group until it works.
3. Refresh credentials: `kops export kubecfg <cluster> --admin` if you get 401/403 or certificate-expiry errors.
4. Check API server health: `kops validate cluster` and the load balancer / master instances in the cloud console.
5. Read the wrapped error to distinguish network (connection refused/timeout) from auth (Unauthorized/Forbidden) and fix accordingly.

Example fix

// before
kops delete instance --name mycluster.example.com i-0abc123
// error: listing nodes in cluster: ... connection refused
// after (when API is intentionally unreachable)
kops delete instance --name mycluster.example.com i-0abc123 --cloudonly --yes
// or fix access first:
// $ kops export kubecfg mycluster.example.com --admin && kubectl get nodes

// probe API reachability before the delete flow:
probeCtx, cancel := context.WithTimeout(ctx, 10*time.Second)
defer cancel()
if _, err := k8sClient.Discovery().ServerVersion(); err != nil {
    return fmt.Errorf("kubernetes API unreachable (%v); use --cloudonly or restore connectivity", err)
}

nodeList, err := kubeClient.CoreV1().Nodes().List(ctx, metav1.ListOptions{})
if err != nil {
    if apierrors.IsUnauthorized(err) || apierrors.IsForbidden(err) {
        return nil, fmt.Errorf("listing nodes in cluster: auth rejected (%v); run 'kops export kubecfg --admin'", err)
    }
    if errors.Is(err, context.DeadlineExceeded) {
        return nil, fmt.Errorf("listing nodes in cluster: API timeout; check network/security groups")
    }
    return nil, fmt.Errorf("listing nodes in cluster: %v", err)
}

When it happens

Trigger: `kops delete instance` (no --cloudonly) where kubeClient.CoreV1().Nodes().List(ctx, metav1.ListOptions{}) errors: API server unreachable/down, DNS not resolving the API endpoint, security group/firewall blocking 443, expired or unauthorized client certificate (401/403), or context deadline exceeded.

Common situations: Deleting an instance in a cluster whose API server is down or being upgraded; running kops from a network that cannot reach the API endpoint (VPN off, security group restriction); expired admin kubecfg credentials; masters unhealthy so the API endpoint fails health checks; slow WAN causing context timeout.

Related errors

• error listing nodes in cluster: %v
• error querying namespace %q: %v
• error querying kubernetes version: %v
• error listing nodes: %v
• error from apply: %w

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/9bbf337ceba6e1dc. Report an issue: GitHub.