{"record":{"id":"5c29894f1ec34342","repo":"kubernetes/kops","slug":"error-listing-routes-w","errorCode":null,"errorMessage":"error listing Routes: %w","messagePattern":"error listing Routes: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/resources/gce/gce.go","lineNumber":748,"sourceCode":"\tc := d.gceCloud\n\n\tvar resourceTrackers []*resources.Resource\n\n\tinstancesToDelete := make(map[string]*resources.Resource)\n\tmigsToDelete := make(map[string]*resources.Resource)\n\tfor _, resource := range resourceMap {\n\t\tswitch resource.Type {\n\t\tcase typeInstance:\n\t\t\tinstancesToDelete[resource.ID] = resource\n\t\tcase typeInstanceGroupManager:\n\t\t\tmigsToDelete[resource.ID] = resource\n\t\t}\n\t}\n\n\t// TODO: Push-down prefix?\n\troutes, err := c.Compute().Routes().List(ctx, c.Project())\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"error listing Routes: %w\", err)\n\t}\n\tfor _, r := range routes {\n\t\tif !d.matchesClusterNameWithUUID(r.Name, maxGCERouteNameLength) {\n\t\t\tcontinue\n\t\t}\n\t\tremove := false\n\t\tfor _, w := range r.Warnings {\n\t\t\tswitch w.Code {\n\t\t\tcase \"NEXT_HOP_INSTANCE_NOT_FOUND\":\n\t\t\t\tremove = true\n\t\t\tcase \"NEXT_HOP_NOT_RUNNING\":\n\t\t\t\t// It might not be running, but it probably exists.\n\t\t\t\tremove = false\n\t\t\tdefault:\n\t\t\t\tklog.Infof(\"Unknown warning on route %q: %q\", r.Name, w.Code)\n\t\t\t}\n\t\t}\n","sourceCodeStart":730,"sourceCodeEnd":766,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/pkg/resources/gce/gce.go#L730-L766","documentation":"Wraps a failure from Compute Routes().List in listRoutes, which enumerates all routes in the project and filters by cluster-name-with-UUID to find routes owned by the cluster. Any List API failure (this is a full-project listing, so it needs broad compute.routes.list permission) aborts discovery with this wrapped error.","triggerScenarios":"c.Compute().Routes().List(ctx, project) fails with 403 permission denied (routes.list not granted), 429 rate limit on list calls, 5xx, or network/timeout failure for large route tables; also service-account impersonation lacking the right scopes.","commonSituations":"Shared VPC host project where kops credentials have no routes.list on that project; projects with thousands of routes hitting timeouts/quota; credential rotation removing compute.networkViewer; GCP API outage during kops delete cluster.","solutions":["Grant compute.routes.list (roles/compute.networkViewer or compute.networkAdmin) to the credentials, including on shared VPC host projects.","Retry with backoff if the wrapped error is 429/5xx.","Reduce route-table pressure: clean up stale routes in the project if listing times out.","Verify the correct project is configured (cluster in a service project but routes in the host project).","Inspect the wrapped error with errors.As for the precise Google API status."],"exampleFix":null,"handlingStrategy":"retry","validationCode":"// pre-check list permission cheaply\n_, err := computeService.Routes.List(project).PageSize(1).Do()\nif err != nil {\n    if gerr, ok := err.(*googleapi.Error); ok && gerr.Code == 403 {\n        return fmt.Errorf(\"service account lacks compute.routes.list on %s\", project)\n    }\n}","typeGuard":"func isGCEAPIError(err error) (*googleapi.Error, bool) {\n    var gerr *googleapi.Error\n    return gerr, errors.As(err, &gerr)\n}","tryCatchPattern":"routes, err := listRoutes(ctx, c)\nif err != nil {\n    var gerr *googleapi.Error\n    if errors.As(err, &gerr) && (gerr.Code == 429 || gerr.Code >= 500) {\n        time.Sleep(backoff); routes, err = listRoutes(ctx, c) // retry once\n    }\n    if err != nil { return err }\n}","preventionTips":["Grant roles/compute.networkViewer so routes.list works, including on shared VPC host projects","Use a context with a generous timeout for large route tables","Prune stale routes from the project periodically","Retry 429/5xx with backoff — List calls are quota-sensitive","Verify the project ID in credentials matches the cluster's project"],"tags":["gce","gcp","routes","listing","api-error"],"backgroundTag":"gce-api-request-failed","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T07:17:12.445Z"}