kubernetes/kops · error
listing resource groups: %w
Error message
listing resource groups: %w
What it means
Wraps any pager error while listing all resource groups in the subscription via resources.ResourceGroupsClient.NewListPager. Unlike the public IP lister, there is no ResourceGroupNotFound tolerance, so any NextPage failure — auth, RBAC, throttling, network — surfaces as this error.
Source
Thrown at upup/pkg/fi/cloudup/azure/resourcegroup.go:51
type resourceGroupsClientImpl struct {
c *resources.ResourceGroupsClient
}
var _ ResourceGroupsClient = (*resourceGroupsClientImpl)(nil)
func (c *resourceGroupsClientImpl) CreateOrUpdate(ctx context.Context, name string, parameters resources.ResourceGroup) error {
_, err := c.c.CreateOrUpdate(ctx, name, parameters, nil)
return err
}
func (c *resourceGroupsClientImpl) List(ctx context.Context) ([]*resources.ResourceGroup, error) {
var l []*resources.ResourceGroup
pager := c.c.NewListPager(nil)
for pager.More() {
resp, err := pager.NextPage(ctx)
if err != nil {
return nil, fmt.Errorf("listing resource groups: %w", err)
}
l = append(l, resp.Value...)
}
return l, nil
}
func (c *resourceGroupsClientImpl) Delete(ctx context.Context, name string) error {
future, err := c.c.BeginDelete(ctx, name, nil)
if err != nil {
return fmt.Errorf("deleting resource group: %w", err)
}
if _, err = future.PollUntilDone(ctx, nil); err != nil {
return fmt.Errorf("waiting for resource group deletion completion: %w", err)
}
return nil
}
func newResourceGroupsClientImpl(subscriptionID string, cred *azidentity.DefaultAzureCredential) (*resourceGroupsClientImpl, error) {View on GitHub (pinned to 4c8573c808)
Solutions
- Refresh credentials (az login / AZURE_* env vars) and confirm the subscription is active
- Grant the identity Reader at subscription scope (Microsoft.Resources/subscriptions/resourceGroups/read)
- Read the inner *azcore.ResponseError StatusCode/ErrorCode; retry with backoff on 429/503
- Verify the subscription ID used to build the client matches the intended subscription
Defensive patterns
Strategy: try-catch
Validate before calling
az account show --query id -o tsv # confirm active subscription before listing az role assignment list --assignee $PRINCIPAL --scope /subscriptions/$SUB_ID -o table
Type guard
func responseError(err error) (*azcore.ResponseError, bool) {
var re *azcore.ResponseError
ok := errors.As(err, &re)
return re, ok
} Try / catch
groups, err := rgClient.List(ctx)
if err != nil {
if re, ok := responseError(err); ok && (re.StatusCode == 429 || re.StatusCode >= 500) {
// retry with backoff
}
return fmt.Errorf("list resource groups: %w", err)
} Prevention
- Refresh credentials before long-running teardown operations
- Grant Reader at subscription scope for listing
- Add backoff retry for ARM 429/503 responses
- Log ResponseError.StatusCode and ErrorCode, not just the message
When it happens
Trigger: resourceGroupsClientImpl.List(ctx) invoked and pager.NextPage(ctx) fails: invalid/expired credentials, identity lacks permission to list resource groups, ARM throttling, or bad subscription ID.
Common situations: Stale Azure credentials after token expiry; identity has no Reader at subscription scope; deletion flow polling resource groups while subscription is disabled or misconfigured.
Related errors
- listing public ip addresses: %w
- deleting resource group: %w
- listing VMSS VMs: %w
- listing disks: %w
- deleting public ip address: %w
AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05).
Data as JSON: /api/errors/b1c38203f933cfa3.
Report an issue: GitHub.