{"record":{"id":"84b4a741193441d5","repo":"kubernetes/kops","slug":"error-updating-healthcheck-q-v","errorCode":null,"errorMessage":"error updating Healthcheck %q: %v","messagePattern":"error updating Healthcheck %q: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"upup/pkg/fi/cloudup/gcetasks/httphealthcheck.go","lineNumber":111,"sourceCode":"\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"error creating Healthcheck %q: %v\", o.Name, err)\n\t\t}\n\t\tif err := t.Cloud.WaitForOp(r); err != nil {\n\t\t\treturn fmt.Errorf(\"error creating Healthcheck: %v\", err)\n\t\t}\n\t\th.SelfLink = r.TargetLink\n\t} else if changes.Port != nil || changes.RequestPath != nil {\n\t\t// Insert only applies these on create, so reconcile changes to an existing check with a separate Update.\n\t\to := &compute.HttpHealthCheck{\n\t\t\tName:        fi.ValueOf(e.Name),\n\t\t\tPort:        fi.ValueOf(e.Port),\n\t\t\tRequestPath: fi.ValueOf(e.RequestPath),\n\t\t}\n\n\t\tklog.V(4).Infof(\"Updating Healthcheck %q\", o.Name)\n\t\tr, err := t.Cloud.Compute().HTTPHealthChecks().Update(t.Cloud.Project(), o.Name, o)\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"error updating Healthcheck %q: %v\", o.Name, err)\n\t\t}\n\t\tif err := t.Cloud.WaitForOp(r); err != nil {\n\t\t\treturn fmt.Errorf(\"error updating Healthcheck: %v\", err)\n\t\t}\n\t}\n\treturn nil\n}\n\ntype terraformHTTPHealthcheck struct {\n\tName        string  `cty:\"name\"`\n\tPort        *int64  `cty:\"port\"`\n\tRequestPath *string `cty:\"request_path\"`\n}\n\nfunc (_ *HTTPHealthcheck) RenderTerraform(t *terraform.TerraformTarget, a, e, changes *HTTPHealthcheck) error {\n\ttf := &terraformHTTPHealthcheck{\n\t\tName:        *e.Name,\n\t\tPort:        e.Port,","sourceCodeStart":93,"sourceCodeEnd":129,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/upup/pkg/fi/cloudup/gcetasks/httphealthcheck.go#L93-L129","documentation":"Insert only applies Port/RequestPath on create, so for an existing HTTPHealthcheck with changes to those fields the task issues a separate HTTPHealthChecks().Update. If Update errors it is wrapped with this message; a subsequent WaitForOp failure is wrapped with the same prefix.","triggerScenarios":"HTTPHealthChecks().Update(project, name, o) fails: IAM denial on compute.healthChecks.update, concurrent modification conflict, invalid new Port/RequestPath values, rate limiting, or API error.","commonSituations":"Changing requestPath/port in the kops cluster spec for an existing instance group health check; another process modified the health check concurrently; missing compute.healthChecks.update IAM permission.","solutions":["Fix the underlying wrapped error: 403 => grant compute.healthChecks.update; 409 => remove the conflicting concurrent operation and retry","Validate the new Port/RequestPath values (port range, path begins with /) in the cluster spec","Retry the apply after backoff for 429/5xx","As a last resort, delete and recreate the health check via a fresh apply"],"exampleFix":"// before (invalid request path in cluster spec)\nrequestPath: \"status\"\n// after\nrequestPath: \"/healthz\"","handlingStrategy":"try-catch","validationCode":"// validate changed fields before update\nif changes.Port != nil && (*changes.Port < 1 || *changes.Port > 65535) { return errors.New(\"invalid port\") }\nif changes.RequestPath != nil && !strings.HasPrefix(*changes.RequestPath, \"/\") { return errors.New(\"requestPath must start with /\") }","typeGuard":null,"tryCatchPattern":"var gerr *googleapi.Error\nif errors.As(err, &gerr) {\n\tswitch gerr.Code {\n\tcase 409: // concurrent modification; retry after the other op finishes\n\tcase 403: // add compute.healthChecks.update IAM\n\tdefault: // inspect payload for field validation errors\n\t}\n}","preventionTips":["Change Port/RequestPath deliberately — they require a full Update on existing checks","Avoid concurrent editors of the same health check","Grant compute.healthChecks.update IAM permission","Re-run the apply after fixing the underlying cause; updates are idempotent"],"tags":["gce","http-health-check","update","cloud-api"],"backgroundTag":"gce-api-update-failed","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T07:17:12.445Z"}