{"record":{"id":"c269bcdbe3f7d7c6","repo":"kubernetes/kops","slug":"getting-firewallrule-q-w","errorCode":null,"errorMessage":"getting FirewallRule %q: %w","messagePattern":"getting FirewallRule %q: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"upup/pkg/fi/cloudup/gcetasks/firewallrule.go","lineNumber":71,"sourceCode":"\tDisabled bool\n}\n\nvar _ fi.CompareWithID = (*FirewallRule)(nil)\nvar _ fi.CloudupTaskNormalize = (*FirewallRule)(nil)\n\nfunc (e *FirewallRule) CompareWithID() *string {\n\treturn e.Name\n}\n\nfunc (e *FirewallRule) Find(c *fi.CloudupContext) (*FirewallRule, error) {\n\tcloud := c.T.Cloud.(gce.GCECloud)\n\n\tr, err := cloud.Compute().Firewalls().Get(cloud.Project(), *e.Name)\n\tif err != nil {\n\t\tif gce.IsNotFound(err) {\n\t\t\treturn nil, nil\n\t\t}\n\t\treturn nil, fmt.Errorf(\"getting FirewallRule %q: %w\", *e.Name, err)\n\t}\n\n\tactual := &FirewallRule{}\n\tactual.Name = &r.Name\n\tactual.Network = &Network{Name: new(lastComponent(r.Network))}\n\tactual.TargetTags = r.TargetTags\n\tactual.SourceRanges = r.SourceRanges\n\tactual.SourceTags = r.SourceTags\n\tactual.Disabled = r.Disabled\n\tfor _, a := range r.Allowed {\n\t\tactual.Allowed = append(actual.Allowed, serializeFirewallAllowed(a))\n\t}\n\n\t// Ignore \"system\" fields\n\tactual.Lifecycle = e.Lifecycle\n\tactual.Family = e.Family\n\n\treturn actual, nil","sourceCodeStart":53,"sourceCodeEnd":89,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/upup/pkg/fi/cloudup/gcetasks/firewallrule.go#L53-L89","documentation":"The GCE FirewallRule task's Find method fetches the firewall rule by name via Compute().Firewalls().Get; any error that is not a GCE notFound is wrapped with this message. It means existence could not be determined due to an API/permission failure, not that the rule is absent.","triggerScenarios":"cloud.Compute().Firewalls().Get(cloud.Project(), *e.Name) returns an error that fails gce.IsNotFound — e.g. 403 permissionDenied, 429 rate limit, 500 backend error, or network failure.","commonSituations":"Service account lacks compute.firewalls.get permission; GCP API rate limiting during large cluster reconciliation; transient GCP outage during kops get/cluster read.","solutions":["Check the wrapped error status for permission vs rate-limit causes","Grant the service account compute.firewalls.get (or compute.viewer) role","Retry after GCP API rate limits/backoff clear","Verify project ID in the kops cluster config is correct"],"exampleFix":null,"handlingStrategy":"retry","validationCode":"// preflight IAM check\n_, err := computeService.Firewalls.Get(project, name).Do()\n// 403 => fix roles before running kops","typeGuard":null,"tryCatchPattern":"r, err := firewalls.Get(project, name).Do()\nif err != nil {\n  if isNotFound(err) { return nil, nil }\n  if isRateLimit(err) { backoffAndRetry() }\n  return nil, fmt.Errorf(\"getting firewall rule: %w\", err)\n}","preventionTips":["Grant compute.firewalls.get / compute.viewer to the service account","Respect GCP API rate limits with backoff","Verify project ID in kops config before reconciliation"],"tags":["gcp","gce","firewall","api-read"],"backgroundTag":"gcp-api-permission-denied","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T07:17:12.445Z"}