{"record":{"id":"b755d2ba4c67db89","repo":"kubernetes/kops","slug":"error-creating-forwardingrule-q-v","errorCode":null,"errorMessage":"error creating ForwardingRule %q: %v","messagePattern":"error creating ForwardingRule %q: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"upup/pkg/fi/cloudup/gcetasks/forwardingrule.go","lineNumber":230,"sourceCode":"\t\t\tproject = *e.Network.Project\n\t\t}\n\t\to.Network = e.Network.URL(project)\n\t}\n\n\tif e.Subnetwork != nil {\n\t\tproject := t.Cloud.Project()\n\t\tif e.Network.Project != nil {\n\t\t\tproject = *e.Network.Project\n\t\t}\n\t\to.Subnetwork = e.Subnetwork.URL(project, t.Cloud.Region())\n\t}\n\n\tif a == nil {\n\t\tklog.V(4).Infof(\"Creating ForwardingRule %q\", o.Name)\n\n\t\top, err := t.Cloud.Compute().ForwardingRules().Insert(ctx, t.Cloud.Project(), t.Cloud.Region(), o)\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"error creating ForwardingRule %q: %v\", o.Name, err)\n\t\t}\n\n\t\tif err := t.Cloud.WaitForOp(op); err != nil {\n\t\t\treturn fmt.Errorf(\"error creating forwarding rule: %v\", err)\n\t\t}\n\n\t\tif e.Labels != nil {\n\t\t\t// We can't set labels on creation; we have to read the object to get the fingerprint\n\t\t\t// TODO: We could get it from the operation!\n\t\t\tr, err := t.Cloud.Compute().ForwardingRules().Get(ctx, t.Cloud.Project(), t.Cloud.Region(), name)\n\t\t\tif err != nil {\n\t\t\t\treturn fmt.Errorf(\"reading created ForwardingRule %q: %v\", name, err)\n\t\t\t}\n\n\t\t\treq := compute.RegionSetLabelsRequest{\n\t\t\t\tLabelFingerprint: r.LabelFingerprint,\n\t\t\t\tLabels:           e.Labels,\n\t\t\t}","sourceCodeStart":212,"sourceCodeEnd":248,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/upup/pkg/fi/cloudup/gcetasks/forwardingrule.go#L212-L248","documentation":"Wraps the error returned by the Google Compute API ForwardingRules.Insert call when kOps attempts to create a new regional forwarding rule (no existing resource was found, a == nil). The underlying GCE error is embedded via %v, so the real cause (quota, invalid field, API error) is in the wrapped message.","triggerScenarios":"RenderGCE creates a rule: ForwardingRules().Insert(ctx, project, region, o) fails — e.g. invalid name/IPProtocol/PortRange/Target/BackendService/Network references, duplicate rule name, quota exceeded, or API auth failure.","commonSituations":"Invalid target pool or backend service URL; referenced subnetwork/network not found in project/region; forwarding-rule quota exhausted in the region; an egg/chicken race where the target was deleted mid-update; expired GCP credentials.","solutions":["Read the wrapped %v cause at the end of the message and address the specific GCE API error (quota, notFound, invalid field)","Verify referenced TargetPool/BackendService/Network/Subnetwork tasks exist and are in the same project/region","Check forwarding-rule quota with `gcloud compute regions describe <region>`","Re-run kops update; transient API errors are safe to retry since the task is idempotent"],"exampleFix":"null","handlingStrategy":"try-catch","validationCode":"// pre-flight: verify quota and referenced targets exist\nop, err := fc.Compute().ForwardingRules().List(ctx, project, region)\n// ensure name is unique; check `gcloud compute project-info describe` for quotas before insert","typeGuard":null,"tryCatchPattern":"op, err := cloud.Compute().ForwardingRules().Insert(ctx, project, region, rule)\nif err != nil {\n    var gerr *googleapi.Error\n    if errors.As(err, &gerr) {\n        klog.Warningf(\"GCE insert failed: code=%d message=%s\", gerr.Code, gerr.Message)\n        if gerr.Code == 409 || gerr.Code == 429 { // conflict/quota: safe to retry later\n            return retryAfterBackoff()\n        }\n    }\n    return fmt.Errorf(\"error creating ForwardingRule %q: %v\", name, err)\n}","preventionTips":["Ensure rule names are unique per region","Verify referenced TargetPool/BackendService/Network/Subnetwork are created earlier in the same apply","Monitor regional forwarding-rule quota before large topology changes","Keep GCP credentials valid; use retry with backoff for 429/5xx"],"tags":["gce","forwarding-rule","api-error","creation"],"backgroundTag":"gce-api-insert-failed","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T07:17:12.445Z"}