kubernetes/kops · error

listing role assignments: %w

Error message

listing role assignments: %w

What it means

Wraps pager errors while enumerating role assignments at a given scope via authz.RoleAssignmentsClient.NewListForScopePager. Any NextPage failure — authorization, network, throttling, invalid scope — is wrapped here when listing role assignments during cluster teardown/reconciliation.

Source

Thrown at upup/pkg/fi/cloudup/azure/roleassignment.go:59

	ctx context.Context,
	scope string,
	roleAssignmentName string,
	parameters authz.RoleAssignmentCreateParameters,
) (*authz.RoleAssignment, error) {
	resp, err := c.c.Create(ctx, scope, roleAssignmentName, parameters, nil)
	if err != nil {
		return nil, err
	}
	return &resp.RoleAssignment, nil
}

func (c *roleAssignmentsClientImpl) List(ctx context.Context, scope string) ([]*authz.RoleAssignment, error) {
	var l []*authz.RoleAssignment
	pager := c.c.NewListForScopePager(scope, nil)
	for pager.More() {
		resp, err := pager.NextPage(ctx)
		if err != nil {
			return nil, fmt.Errorf("listing role assignments: %w", err)
		}
		l = append(l, resp.Value...)
	}
	return l, nil
}

func (c *roleAssignmentsClientImpl) Delete(ctx context.Context, scope, raName string) error {
	_, err := c.c.Delete(ctx, scope, raName, nil)
	if err != nil {
		return fmt.Errorf("deleting role assignment: %w", err)
	}
	return nil
}

func newRoleAssignmentsClientImpl(subscriptionID string, cred *azidentity.DefaultAzureCredential) (*roleAssignmentsClientImpl, error) {
	c, err := authz.NewRoleAssignmentsClient(subscriptionID, cred, nil)
	if err != nil {
		return nil, fmt.Errorf("creating role assignments client: %w", err)

View on GitHub (pinned to 4c8573c808)

Solutions

1. Verify the scope string is a fully-qualified ARM path like /subscriptions/<id>/resourceGroups/<rg>
2. Grant the identity Microsoft.Authorization/roleAssignments/read at the scope
3. Check the wrapped *azcore.ResponseError code and retry with backoff for 429/503
4. Confirm the scope's resource group/subscription still exists before listing

scope := fmt.Sprintf("/subscriptions/%s/resourceGroups/%s", subID, rgName)
if !strings.HasPrefix(scope, "/subscriptions/") || strings.Contains(scope, "//") {
  return errors.New("azure: invalid role assignment scope path")
}

func validScope(s string) bool {
  return regexp.MustCompile(`^/subscriptions/[^/]+(/resourceGroups/[^/]+)?(/providers/[^/]+.*)?$`).MatchString(s)
}

ras, err := raClient.List(ctx, scope)
var re *azcore.ResponseError
if errors.As(err, &re) && re.StatusCode == 403 {
  return nil, fmt.Errorf("needs Microsoft.Authorization/roleAssignments/read at %s: %w", scope, err)
}

When it happens

Trigger: roleAssignmentsClientImpl.List(ctx, scope) with a malformed scope string (not a valid ARM scope path), or NextPage failing due to RBAC (identity lacks Microsoft.Authorization/roleAssignments/read), throttling, or connectivity.

Common situations: Scope built from a wrong resource group name or empty field producing an invalid ARM path; identity with Contributor but no read on role assignments (requires Owner/Reader+ at the scope); ARM 429 on large subscriptions.

Related errors

• deleting role assignment: %w
• updating Role Assignment is not yet implemented
• listing disks: %w
• listing public ip addresses: %w
• listing resource groups: %w

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/48b45bd6788cfcf2. Report an issue: GitHub.