{"record":{"id":"bb8fdb69caf9944f","repo":"kubernetes/kops","slug":"error-getting-iam-policy-for-project-s-w","errorCode":null,"errorMessage":"error getting IAM policy for project %s: %w","messagePattern":"error getting IAM policy for project (.+?): %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"upup/pkg/fi/cloudup/gcetasks/projectiambinding.go","lineNumber":119,"sourceCode":"\treturn nil\n}\n\nfunc (_ *ProjectIAMBinding) RenderGCE(t *gce.GCEAPITarget, a, e, changes *ProjectIAMBinding) error {\n\tctx := context.TODO()\n\n\tprojectID := fi.ValueOf(e.Project)\n\tmember := \"serviceAccount:\" + fi.ValueOf(e.MemberServiceAccount.Email)\n\trole := fi.ValueOf(e.Role)\n\n\t// Avoid concurrent operations\n\tlocalMutex := gce.MutexForProjectIAM(projectID)\n\tlocalMutex.Lock()\n\tdefer localMutex.Unlock()\n\n\trequest := &cloudresourcemanager.GetIamPolicyRequest{}\n\tpolicy, err := t.Cloud.CloudResourceManager().Projects.GetIamPolicy(projectID, request).Context(ctx).Do()\n\tif err != nil {\n\t\treturn fmt.Errorf(\"error getting IAM policy for project %s: %w\", projectID, err)\n\t}\n\n\tchanged := patchCRMPolicy(policy, member, role)\n\n\tif !changed {\n\t\tklog.Warningf(\"did not need to change policy (concurrent change?)\")\n\t\treturn nil\n\t}\n\n\tklog.V(2).Infof(\"updating IAM for project %s\", projectID)\n\tif _, err := t.Cloud.CloudResourceManager().Projects.SetIamPolicy(projectID, &cloudresourcemanager.SetIamPolicyRequest{Policy: policy}).Context(ctx).Do(); err != nil {\n\t\treturn fmt.Errorf(\"error updating IAM for project %s: %w\", projectID, err)\n\t}\n\n\treturn nil\n}\n\n// terraformProjectIAMBinding is the model for a terraform google_project_iam_binding rule","sourceCodeStart":101,"sourceCodeEnd":137,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/upup/pkg/fi/cloudup/gcetasks/projectiambinding.go#L101-L137","documentation":"Wrapped error from ProjectIAMBinding.RenderGCE when the GetIamPolicy call fails during the apply phase (under a per-project mutex to avoid concurrent modifications). The request itself is a plain GetIamPolicy; failure means permissions, project, or API issues.","triggerScenarios":"Thrown at upup/pkg/fi/cloudup/gcetasks/projectiambinding.go:119 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Inspect the wrapped error for the exact CRM failure","Ensure the kOps service account can read the project's IAM policy","Retry after resolving permissions or transient errors"],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T07:17:12.445Z"}