{"record":{"id":"6385db165fda5887","repo":"kubernetes/kops","slug":"error-listing-subnetworks-in-region-q-w","errorCode":null,"errorMessage":"error listing Subnetworks in region %q: %w","messagePattern":"error listing Subnetworks in region %q: %w","errorType":"error_code","errorClass":null,"httpStatus":null,"severity":"error","filePath":"upup/pkg/fi/cloudup/gce/network.go","lineNumber":131,"sourceCode":"\t\treturn used, nil\n\t}\n\n\tklog.Infof(\"scanning regions for subnetwork CIDR allocations\")\n\n\tregions := make(map[string]bool)\n\tfor subnetURL := range subnetURLs {\n\t\tu, err := ParseGoogleCloudURL(subnetURL)\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"error parsing subnet url %q: %w\", subnetURL, err)\n\t\t}\n\t\tregions[u.Region] = true\n\t}\n\n\tvar subnets []*compute.Subnetwork\n\tfor region := range regions {\n\t\tl, err := cloud.Compute().Subnetworks().List(ctx, cloud.Project(), region)\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"error listing Subnetworks in region %q: %w\", region, err)\n\t\t}\n\t\tsubnets = append(subnets, l...)\n\t}\n\n\tfor _, subnet := range subnets {\n\t\tif !subnetURLs[subnet.SelfLink] {\n\t\t\tcontinue\n\t\t}\n\t\tif err := used.MarkInUse(subnet.IpCidrRange); err != nil {\n\t\t\treturn nil, err\n\t\t}\n\n\t\tfor _, s := range subnet.SecondaryIpRanges {\n\t\t\tif err := used.MarkInUse(s.IpCidrRange); err != nil {\n\t\t\t\treturn nil, err\n\t\t\t}\n\t\t}\n\t}","sourceCodeStart":113,"sourceCodeEnd":149,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/upup/pkg/fi/cloudup/gce/network.go#L113-L149","documentation":"After deriving the set of regions from subnet URLs, buildUsed lists all subnetworks in each region to compute allocated CIDRs. Any non-nil error from Subnetworks().List is wrapped as this error with the region name. NotFound is not specially handled here, so a bad region or missing compute permissions also lands here.","triggerScenarios":"Compute API error while listing subnetworks in a region (quota, 5xx, throttling); a region name parsed from a subnet URL that does not exist in the project; service account lacking compute.subnetworks.list permission.","commonSituations":"Shared VPC where the service project's service account cannot list subnets in the host project's region; typo in region in a custom subnet self-link; transient GCP outage during kops update.","solutions":["Retry the kops command to rule out transient API failures","Grant compute.subnetworks.list (Compute Network Viewer) on the relevant project (host project for Shared VPC)","Verify the region in each subnet self-link exists and matches the cluster's region","Check GCP quotas and API status for the project"],"exampleFix":null,"handlingStrategy":"retry","validationCode":"// verify list permission beforehand\n// gcloud compute networks list --project=PROJECT  (and subnets list per region)","typeGuard":null,"tryCatchPattern":"used, err := buildUsed(ctx, cluster, cloud)\nif err != nil && strings.Contains(err.Error(), \"error listing Subnetworks\") {\n\tvar gerr *googleapi.Error\n\tif errors.As(err, &gerr) && (gerr.Code == 429 || gerr.Code >= 500) {\n\t\t// transient: retry with backoff\n\t}\n\treturn err\n}","preventionTips":["Grant compute.subnetworks.list on the host project when using Shared VPC","Verify regions in subnet self-links exist in the target project","Add backoff/retry wrappers around kops operations during GCP incidents","Watch Compute API quotas in the project"],"tags":["gce","subnet","gcp-api","permissions"],"backgroundTag":"gcp-api-permission-denied","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T07:17:12.445Z"}