kubernetes/kops · error

LoadBalancers.List returned error: %v

Error message

LoadBalancers.List returned error: %v

What it means

GetApiIngressStatus retries (vfs.RetryWithBackoff) listing DigitalOcean load balancers via c.GetAllLoadBalancers() to find the API load balancer named 'api-<cluster-name>'. If the list call itself fails, the error is wrapped with 'LoadBalancers.List returned error'. This is a read-path failure, not a load balancer state problem.

Source

Thrown at upup/pkg/fi/cloudup/do/cloud.go:280

		return "", err
	}

	if done {
		return vpcUUID, nil
	} else {
		return "", wait.ErrWaitTimeout
	}
}

func (c *doCloudImplementation) GetApiIngressStatus(cluster *kops.Cluster) ([]fi.ApiIngressStatus, error) {
	var ingresses []fi.ApiIngressStatus
	done, err := vfs.RetryWithBackoff(readBackoff, func() (bool, error) {
		// Note that this must match Digital Ocean's lb name
		klog.V(2).Infof("Querying DO to find Loadbalancers for API (%q)", cluster.Name)

		loadBalancers, err := c.GetAllLoadBalancers()
		if err != nil {
			return false, fmt.Errorf("LoadBalancers.List returned error: %v", err)
		}

		lbName := "api-" + strings.ReplaceAll(cluster.Name, ".", "-")

		for _, lb := range loadBalancers {
			if lb.Name == lbName {
				klog.V(10).Infof("Matching LB name found for API (%q)", cluster.Name)

				if lb.Status != "active" {
					return false, fmt.Errorf("load-balancer is not yet active (current status: %s)", lb.Status)
				}

				address := lb.IP
				ingresses = append(ingresses, fi.ApiIngressStatus{IP: address})
			}
		}
		return true, nil
	})

View on GitHub (pinned to 4c8573c808)

Solutions

1. Check the wrapped error: 401/403 means fix the DO API token scopes; 429 means back off and retry later.
2. Verify network egress to api.digitalocean.com from the machine running kOps.
3. Re-run the command — RetryWithBackoff already retries transient failures; persistent failure indicates auth or connectivity.
4. Confirm the DO account/team the token belongs to actually owns the load balancer (token scoped to wrong team returns empty/forbidden lists).

// verify connectivity and token before listing
_, _, err := client.LoadBalancers.List(context.TODO(), nil)
if err != nil { return fmt.Errorf("DO API unreachable or unauthorized: %w", err) }

ingress, err := cloud.GetApiIngressStatus(cluster)
if err != nil {
    if isRateLimited(err) { backoff(); retry() }
    return fmt.Errorf("DO LB list failed: %w", err)
}

When it happens

Trigger: GetAllLoadBalancers() (backed by godo LoadBalancers.List) fails due to API auth errors, rate limiting (429), network failures, or region-scoped API errors while kOps is trying to report the API server ingress address.

Common situations: Expired/invalid DO API token; hitting DO rate limits during heavy cluster operations; transient network outages between the kOps host and DO; using kOps from an environment without egress to api.digitalocean.com.

Related errors

• failed to retrieve droplet %d: %w
• failed to list vpcs: %v
• failed to get load balancers matching label selector %q: %w
• failed to get droplet region: %s
• failed to get metadata URL %s: %v

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/8bf84b57bcfcebb6. Report an issue: GitHub.