{"record":{"id":"1b27c81afac378a0","repo":"kubernetes/kops","slug":"error-listing-health-checks-v","errorCode":null,"errorMessage":"error listing Health Checks: %v","messagePattern":"error listing Health Checks: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"upup/pkg/fi/cloudup/gcetasks/healthcheck.go","lineNumber":87,"sourceCode":"\t}\n\treturn actual, err\n}\n\nfunc (e *HealthCheck) URL(cloud gce.GCECloud) string {\n\treturn fmt.Sprintf(\"https://www.googleapis.com/compute/v1/projects/%s/regions/%s/healthChecks/%s\",\n\t\tcloud.Project(),\n\t\tcloud.Region(),\n\t\t*e.Name)\n}\n\nfunc (e *HealthCheck) find(cloud gce.GCECloud) (*HealthCheck, error) {\n\tr, err := cloud.Compute().RegionHealthChecks().Get(cloud.Project(), cloud.Region(), *e.Name)\n\tif err != nil {\n\t\tif gce.IsNotFound(err) {\n\t\t\treturn nil, nil\n\t\t}\n\n\t\treturn nil, fmt.Errorf(\"error listing Health Checks: %v\", err)\n\t}\n\n\tactual := &HealthCheck{}\n\tactual.Name = &r.Name\n\tswitch r.Type {\n\tcase \"SSL\":\n\t\tactual.Protocol = HealthCheckProtocolSSL\n\t\tif r.SslHealthCheck != nil {\n\t\t\tactual.Port = r.SslHealthCheck.Port\n\t\t}\n\tdefault:\n\t\tactual.Protocol = HealthCheckProtocolTCP\n\t\tif r.TcpHealthCheck != nil {\n\t\t\tactual.Port = r.TcpHealthCheck.Port\n\t\t}\n\t}\n\n\treturn actual, nil","sourceCodeStart":69,"sourceCodeEnd":105,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/upup/pkg/fi/cloudup/gcetasks/healthcheck.go#L69-L105","documentation":"HealthCheck.Find reconciles desired vs actual state by calling RegionHealthChecks().Get. NotFound is treated as 'doesn't exist' (returns nil,nil), but any other API error is wrapped as this error and aborts reconciliation.","triggerScenarios":"cloud.Compute().RegionHealthChecks().Get(project, region, name) returns a non-NotFound error: auth failure, permission denied on compute.healthChecks.get, quota/rate limit, network failure, or malformed name.","commonSituations":"Service account missing compute.healthChecks.get; regional health check exists in a different region than the cluster's; GCE API outage; token expired in long-running operations.","solutions":["Inspect the wrapped error code: 403 => grant compute.healthChecks.get / compute.viewer IAM role","Retry the apply after backoff for transient 429/5xx errors","Verify the health check's region matches the cluster region (cloud.Region())","Refresh credentials (gcloud auth application-default login / fix GOOGLE_CREDENTIALS) if auth errors appear"],"exampleFix":"null","handlingStrategy":"retry","validationCode":"// ensure credential/permission sanity before reconcile\ngcloud projects get-iam-policy PROJECT --format=json | grep compute.healthChecks","typeGuard":null,"tryCatchPattern":"if _, err := hc.Find(context); err != nil {\n\tvar gerr *googleapi.Error\n\tif errors.As(err, &gerr) && (gerr.Code == 429 || gerr.Code >= 500) {\n\t\t// back off and retry the reconcile\n\t}\n}","preventionTips":["Grant compute.healthChecks.get (or compute.viewer) to the kops service account","Handle NotFound as absence, not failure (kops already does)","Keep credentials fresh for long-running applies","Match region: regional health checks live in the cluster region"],"tags":["gce","health-check","reconciliation","cloud-api"],"backgroundTag":"gce-api-get-failed","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T07:17:12.445Z"}