{"record":{"id":"c3dbc4be37cb366c","repo":"kubernetes/kops","slug":"error-creating-healthcheck-v","errorCode":null,"errorMessage":"error creating healthcheck: %v","messagePattern":"error creating healthcheck: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"upup/pkg/fi/cloudup/gcetasks/healthcheck.go","lineNumber":152,"sourceCode":"\tswitch e.protocol() {\n\tcase HealthCheckProtocolSSL:\n\t\thc.Type = \"SSL\"\n\t\thc.SslHealthCheck = &compute.SSLHealthCheck{\n\t\t\tPort: e.Port,\n\t\t}\n\tdefault:\n\t\thc.Type = \"TCP\"\n\t\thc.TcpHealthCheck = &compute.TCPHealthCheck{\n\t\t\tPort: e.Port,\n\t\t}\n\t}\n\n\tif a == nil {\n\t\tklog.V(2).Infof(\"Creating HealthCheck %q\", hc.Name)\n\n\t\top, err := cloud.Compute().RegionHealthChecks().Insert(cloud.Project(), cloud.Region(), hc)\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"error creating healthcheck: %v\", err)\n\t\t}\n\n\t\tif err := cloud.WaitForOp(op); err != nil {\n\t\t\treturn fmt.Errorf(\"error waiting for healthcheck: %v\", err)\n\t\t}\n\t} else {\n\t\treturn fmt.Errorf(\"cannot apply changes to healthcheck: %v\", changes)\n\t}\n\n\treturn nil\n}\n\ntype terraformHealthCheckBlock struct {\n\tPort int64 `cty:\"port\"`\n}\n\ntype terraformHealthCheck struct {\n\tName           string                     `cty:\"name\"`","sourceCodeStart":134,"sourceCodeEnd":170,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/upup/pkg/fi/cloudup/gcetasks/healthcheck.go#L134-L170","documentation":"In RenderGCE, when the health check does not exist (actual == nil), the task inserts it via RegionHealthChecks().Insert. If the Insert call itself returns an error (before waiting on the operation), it is wrapped with this message.","triggerScenarios":"RegionHealthChecks().Insert(project, region, hc) fails immediately: invalid HealthCheck spec (bad port/protocol fields), duplicate name in region, permission denied on compute.healthChecks.create, quota exceeded, or API error.","commonSituations":"IAM missing compute.healthChecks.create; a stale health check with the same name exists but Find failed to see it; malformed request path/port from cluster spec; exceeding regional health-check quota.","solutions":["Fix the underlying error: check name conflicts and quota in the GCE console for that region","Grant compute.healthChecks.create (roles/compute.networkAdmin) to the service account","Validate the cluster spec's health check fields (port range, protocol) before applying","Retry after backoff if the wrapped code is 429/5xx"],"exampleFix":"null","handlingStrategy":"validation","validationCode":"// validate spec before apply\nif hc.Port < 1 || hc.Port > 65535 { return errors.New(\"invalid health check port\") }\nif existing != nil { return errors.New(\"health check already exists; update not supported\") }","typeGuard":null,"tryCatchPattern":"var gerr *googleapi.Error\nif errors.As(err, &gerr) && gerr.Code == 409 {\n\t// name conflict: fetch the existing check and reconcile instead of inserting\n}","preventionTips":["Validate health check fields (port, protocol, interval) in the cluster spec before applying","Avoid duplicate health check names within the region","Grant compute.healthChecks.create IAM permission","Watch regional health-check quota before scaling out"],"tags":["gce","health-check","create","cloud-api"],"backgroundTag":"gce-api-insert-failed","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T07:17:12.445Z"}