{"record":{"id":"a8c4d495688005a1","repo":"kubernetes/kops","slug":"setting-forwardingrule-labels-w","errorCode":null,"errorMessage":"setting ForwardingRule labels: %w","messagePattern":"setting ForwardingRule labels: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"upup/pkg/fi/cloudup/gcetasks/forwardingrule.go","lineNumber":251,"sourceCode":"\t\tif err := t.Cloud.WaitForOp(op); err != nil {\n\t\t\treturn fmt.Errorf(\"error creating forwarding rule: %v\", err)\n\t\t}\n\n\t\tif e.Labels != nil {\n\t\t\t// We can't set labels on creation; we have to read the object to get the fingerprint\n\t\t\t// TODO: We could get it from the operation!\n\t\t\tr, err := t.Cloud.Compute().ForwardingRules().Get(ctx, t.Cloud.Project(), t.Cloud.Region(), name)\n\t\t\tif err != nil {\n\t\t\t\treturn fmt.Errorf(\"reading created ForwardingRule %q: %v\", name, err)\n\t\t\t}\n\n\t\t\treq := compute.RegionSetLabelsRequest{\n\t\t\t\tLabelFingerprint: r.LabelFingerprint,\n\t\t\t\tLabels:           e.Labels,\n\t\t\t}\n\t\t\top, err := t.Cloud.Compute().ForwardingRules().SetLabels(ctx, t.Cloud.Project(), t.Cloud.Region(), o.Name, &req)\n\t\t\tif err != nil {\n\t\t\t\treturn fmt.Errorf(\"setting ForwardingRule labels: %w\", err)\n\t\t\t}\n\n\t\t\tif err := t.Cloud.WaitForOp(op); err != nil {\n\t\t\t\treturn fmt.Errorf(\"setting ForwardRule labels: %w\", err)\n\t\t\t}\n\t\t}\n\t} else {\n\t\tif changes.Labels != nil {\n\t\t\treq := compute.RegionSetLabelsRequest{\n\t\t\t\tLabelFingerprint: a.labelFingerprint,\n\t\t\t\tLabels:           e.Labels,\n\t\t\t}\n\t\t\top, err := t.Cloud.Compute().ForwardingRules().SetLabels(ctx, t.Cloud.Project(), t.Cloud.Region(), o.Name, &req)\n\t\t\tif err != nil {\n\t\t\t\treturn fmt.Errorf(\"setting ForwardingRule labels: %w\", err)\n\t\t\t}\n\n\t\t\tif err := t.Cloud.WaitForOp(op); err != nil {","sourceCodeStart":233,"sourceCodeEnd":269,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/upup/pkg/fi/cloudup/gcetasks/forwardingrule.go#L233-L269","documentation":"During creation, the SetLabels API call for a newly created forwarding rule failed. The label fingerprint was freshly fetched from Get, so failure usually indicates an API-level problem rather than a stale fingerprint.","triggerScenarios":"ForwardingRules().SetLabels(ctx, project, region, o.Name, &req) returns an error right after creation: invalid label keys/values, permission denied, or API failure.","commonSituations":"Label keys/values violating GCE rules (uppercase, >63 chars, invalid characters); service account lacking compute.forwardingRules.setLabels; region quota of labels exceeded; concurrent fingerprint change.","solutions":["Validate label keys/values against GCE constraints (lowercase, hyphens/underscores, ≤63 chars)","Check IAM permission compute.forwardingRules.setLabels for the kOps service account","Re-run kops update to retry; on fingerprint conflicts the new run re-fetches the fingerprint","Inspect the wrapped error for the exact GCE API reason"],"exampleFix":"// before: invalid label value\nlabels: {\"Kops.k8s.io/Cluster\": \"my.Cluster.example.com\"}\n\n// after: normalized value\nlabels: {\"kops-k8s-io-cluster\": \"my-cluster-example-com\"}","handlingStrategy":"validation","validationCode":"// validate labels against GCE constraints before calling SetLabels\nfunc validGCELabels(labels map[string]string) bool {\n    re := regexp.MustCompile(`^[a-z0-9_-]{1,63}$`)\n    if len(labels) > 64 { return false }\n    for k, v := range labels {\n        if !re.MatchString(k) || !re.MatchString(v) { return false }\n    }\n    return true\n}","typeGuard":null,"tryCatchPattern":"op, err := cloud.Compute().ForwardingRules().SetLabels(ctx, project, region, name, &req)\nif err != nil {\n    var gerr *googleapi.Error\n    if errors.As(err, &gerr) && gerr.Code == 412 { // precondition: fingerprint changed\n        return refreshFingerprintAndRetry()\n    }\n    return fmt.Errorf(\"setting ForwardingRule labels: %w\", err)\n}","preventionTips":["Sanitize label keys/values to GCE rules (lowercase alphanumerics, hyphen/underscore, ≤63 chars)","Avoid external automation that races kOps on forwarding-rule labels","Ensure compute.forwardingRules.setLabels IAM permission","Re-run kops update to re-fetch a fresh fingerprint after conflicts"],"tags":["gce","forwarding-rule","labels","api-error"],"backgroundTag":"label-fingerprint-conflict","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T12:17:11.808Z"}