{"record":{"id":"2165f206f17d2553","repo":"kubernetes/kops","slug":"error-deleting-router-s-v","errorCode":null,"errorMessage":"error deleting router %s: %v","messagePattern":"error deleting router (.+?): (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/resources/gce/gce.go","lineNumber":1006,"sourceCode":"}\n\nfunc deleteRouter(cloud fi.Cloud, r *resources.Resource) error {\n\tc := cloud.(gce.GCECloud)\n\to := r.Obj.(*compute.Router)\n\n\tklog.V(2).Infof(\"deleting GCE router %s\", o.SelfLink)\n\tu, err := gce.ParseGoogleCloudURL(o.SelfLink)\n\tif err != nil {\n\t\treturn err\n\t}\n\n\top, err := c.Compute().Routers().Delete(u.Project, u.Region, u.Name)\n\tif err != nil {\n\t\tif gce.IsNotFound(err) {\n\t\t\tklog.Infof(\"Router not found, assuming deleted: %q\", o.SelfLink)\n\t\t\treturn nil\n\t\t}\n\t\treturn fmt.Errorf(\"error deleting router %s: %v\", o.SelfLink, err)\n\t}\n\n\treturn c.WaitForOp(op)\n}\n\nfunc (d *clusterDiscoveryGCE) listServiceAccounts() ([]*resources.Resource, error) {\n\tc := d.gceCloud\n\tctx := context.Background()\n\n\tsas, err := c.IAM().ServiceAccounts().List(ctx, fmt.Sprintf(\"projects/%s\", c.Project()))\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"error listing ServiceAccounts %w\", err)\n\t}\n\tvar resourceTrackers []*resources.Resource\n\tfor _, sa := range sas {\n\t\ttokens := strings.Split(gce.LastComponent(sa.Name), \"@\")\n\t\tif len(tokens) != 2 {\n\t\t\treturn nil, fmt.Errorf(\"Invalid service account email '%s'\", gce.LastComponent(sa.Name))","sourceCodeStart":988,"sourceCodeEnd":1024,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/pkg/resources/gce/gce.go#L988-L1024","documentation":"Thrown by deleteRouter when Compute Routers().Delete fails with any error except NotFound. The cluster's Cloud Router (used by NAT etc.) could not be removed; the wrapped self-link and API error identify which router and why.","triggerScenarios":"Routers().Delete(project, region, name) returns 403 (no delete permission), 400 failedPrecondition (router attached to resources like Cloud NAT or interconnects still in use), 409 conflict, or transient 5xx.","commonSituations":"Cloud NAT configs still referencing the router during cluster teardown; restricted IAM for the deletion identity; router in a state locked by another operation; API throttling during mass deletion.","solutions":["Check the wrapped error code; handle 'still in use' by deleting dependent Cloud NAT configs first.","Ensure the identity has compute.routers.delete (compute.networkAdmin role).","Retry on 409/429/5xx with backoff; deletion is idempotent since NotFound returns success.","Verify manually with `gcloud compute routers list` and delete leftovers with `gcloud compute routers delete`."],"exampleFix":"// before\nreturn fmt.Errorf(\"error deleting router %s: %v\", o.SelfLink, err)\n// after\nif apiErr, ok := err.(*googleapi.Error); ok && apiErr.Code == 400 && strings.Contains(apiErr.Message, \"being used\") {\n\treturn fmt.Errorf(\"router %s still in use (delete Cloud NAT configs first): %w\", o.SelfLink, err)\n}\nreturn fmt.Errorf(\"error deleting router %s: %w\", o.SelfLink, err)","handlingStrategy":"retry","validationCode":"// before delete, verify no Cloud NAT depends on the router\nnats, err := computeClient.Nats().List(ctx, project, region)\nif err == nil {\n\tfor _, n := range nats {\n\t\tif n.Router == routerName { return fmt.Errorf(\"router %s used by NAT %s\", routerName, n.Name) }\n\t}\n}","typeGuard":"func isStillInUse(err error) bool {\n\tge, ok := err.(*googleapi.Error)\n\treturn ok && ge.Code == 400 && strings.Contains(ge.Message, \"being used\")\n}","tryCatchPattern":"if err := deleteRouter(project, region, name); err != nil {\n\tvar ge *googleapi.Error\n\tif errors.As(err, &ge) && (ge.Code == 409 || ge.Code == 429 || ge.Code >= 500) {\n\t\t// backoff and retry\n\t} else if gce.IsNotFound(err) {\n\t\treturn nil // already gone\n\t}\n\treturn err\n}","preventionTips":["Delete Cloud NAT configs before the router.","Grant compute.networkAdmin to the teardown identity.","Re-run deletion; NotFound is treated as success so it's idempotent."],"tags":["gce","router","deletion","cloud-api"],"backgroundTag":"gce-resource-delete-failed","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T07:17:12.445Z"}