kubernetes/kops · error

listing virtual networks: %w

Error message

listing virtual networks: %w

What it means

Wrapped when paging through virtual networks in a resource group fails, but only after the special case where the whole resource group does not exist (which returns nil, nil). Any other pager error — RBAC denial, throttling, network failure — is wrapped here. Callers of List treat this as a hard failure of inventory discovery.

Source

Thrown at upup/pkg/fi/cloudup/azure/virtualnetwork.go:68

	}
	return &vnet.VirtualNetwork, err
}

func (c *virtualNetworksClientImpl) List(ctx context.Context, resourceGroupName string) ([]*network.VirtualNetwork, error) {
	if resourceGroupName == "" {
		return nil, nil
	}

	var l []*network.VirtualNetwork
	pager := c.c.NewListPager(resourceGroupName, nil)
	for pager.More() {
		resp, err := pager.NextPage(ctx)
		if err != nil {
			var respErr *azcore.ResponseError
			if errors.As(err, &respErr) && respErr.ErrorCode == "ResourceGroupNotFound" {
				return nil, nil
			}
			return nil, fmt.Errorf("listing virtual networks: %w", err)
		}
		l = append(l, resp.Value...)
	}
	return l, nil
}

func (c *virtualNetworksClientImpl) Delete(ctx context.Context, resourceGroupName, vnetName string) error {
	future, err := c.c.BeginDelete(ctx, resourceGroupName, vnetName, nil)
	if err != nil {
		return fmt.Errorf("deleting virtual network: %w", err)
	}
	if _, err = future.PollUntilDone(ctx, nil); err != nil {
		return fmt.Errorf("waiting for virtual network deletion completion: %w", err)
	}
	return nil
}

func newVirtualNetworksClientImpl(subscriptionID string, cred *azidentity.DefaultAzureCredential) (*virtualNetworksClientImpl, error) {

View on GitHub (pinned to 4c8573c808)

Solutions

1. Grant the principal Reader/Network Contributor on the resource group
2. Retry with backoff if the wrapped error is a 429/throttle ResponseError
3. Confirm the resource group name matches the cluster spec (a missing group is silently tolerated, other errors are not)
4. Check connectivity to management.azure.com

// Go: verify permissions/read access before listing
// (no local pre-check possible; grant Reader on the RG in advance)
az role assignment create --assignee <principal> --role Reader --resource-group <rg>

func isRetryableListError(err error) bool {
    var respErr *azcore.ResponseError
    return errors.As(err, &respErr) && respErr.StatusCode == http.StatusTooManyRequests
}

vnets, err := vnetsClient.List(ctx, rg)
if err != nil {
    var respErr *azcore.ResponseError
    if errors.As(err, &respErr) && respErr.StatusCode == http.StatusTooManyRequests {
        // back off and retry per Retry-After header
    }
    return fmt.Errorf("cannot enumerate vnets (check RG name and RBAC): %w", err)
}

When it happens

Trigger: virtualNetworksClientImpl.List's pager.NextPage(ctx) returns a non-ResponseError error, or a ResponseError whose ErrorCode is anything other than ResourceGroupNotFound (e.g. AuthorizationFailed, TooManyRequests).

Common situations: Service principal lacks Microsoft.Network/virtualNetworks/read; ARM throttling (429) in a busy subscription; transient network errors; listing in a partially deleted resource group hitting other ARM errors.

Related errors

• creating/updating virtual network: %w
• deleting virtual network: %w
• waiting for virtual network deletion completion: %w
• waiting for virtual network create/update completion: %w
• listing VMSSs: %w

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/8ee5c6ba59e2221e. Report an issue: GitHub.