{"record":{"id":"c4c3a6047063a05c","repo":"kubernetes/kops","slug":"error-creating-router-w","errorCode":null,"errorMessage":"error creating Router: %w","messagePattern":"error creating Router: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"upup/pkg/fi/cloudup/gcetasks/router.go","lineNumber":173,"sourceCode":"\t\t\tNetwork: e.Network.URL(project),\n\t\t\tNats: []*compute.RouterNat{\n\t\t\t\t{\n\t\t\t\t\tName:                          *e.Name,\n\t\t\t\t\tNatIpAllocateOption:           *e.NATIPAllocationOption,\n\t\t\t\t\tSourceSubnetworkIpRangesToNat: *e.SourceSubnetworkIPRangesToNAT,\n\t\t\t\t},\n\t\t\t},\n\t\t}\n\n\t\tfor _, subnet := range e.Subnetworks {\n\t\t\trouter.Nats[0].Subnetworks = append(router.Nats[0].Subnetworks, &compute.RouterNatSubnetworkToNat{\n\t\t\t\tName:                subnet.URL(project, region),\n\t\t\t\tSourceIpRangesToNat: []string{subnetNatAllIPRanges},\n\t\t\t})\n\t\t}\n\t\top, err := t.Cloud.Compute().Routers().Insert(project, region, router)\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"error creating Router: %w\", err)\n\t\t}\n\t\tif err := t.Cloud.WaitForOp(op); err != nil {\n\t\t\treturn fmt.Errorf(\"error waiting for router creation: %w\", err)\n\t\t}\n\t} else {\n\t\tif !reflect.DeepEqual(changes, &Router{}) {\n\t\t\treturn fmt.Errorf(\"applying changes to Router is unsupported: %s\", *e.Name)\n\t\t}\n\t}\n\n\treturn nil\n}\n\ntype terraformRouterNat struct {\n\tName                          *string                         `cty:\"name\"`\n\tRegion                        *string                         `cty:\"region\"`\n\tRouter                        *terraformWriter.Literal        `cty:\"router\"`\n\tNATIPAllocateOption           *string                         `cty:\"nat_ip_allocate_option\"`","sourceCodeStart":155,"sourceCodeEnd":191,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/upup/pkg/fi/cloudup/gcetasks/router.go#L155-L191","documentation":"This error is returned by the GCE Router task's RenderGCE when the google Compute API call Routers().Insert() fails while kOps tries to create a Cloud Router (used for Cloud NAT) in the target project/region. It wraps the underlying Google API error, so the root cause (quota, permission, invalid config, API error) is in the wrapped %w error. It means the router resource was never created and the apply of this task failed.","triggerScenarios":"Routers().Insert(project, region, router) returns a non-nil error during `kops update cluster` on GCE: e.g. the compute API is disabled, the service account lacks compute.routers.create, the region is wrong, a router with the same name exists in a conflicting state, or quota/billing issues.","commonSituations":"New GCE projects where the Compute Engine API was just enabled and propagation is pending; IAM scopes on the node/service account missing compute rights; deploying to a region typo'd in the cluster spec; Google API transient 5xx/rate-limit errors during cluster creation.","solutions":["Read the wrapped error in the message for the exact Google API cause (permissionDenied, quotaExceeded, notFound, etc.) and address that first","Verify the Compute Engine API is enabled in the project (gcloud services list --enabled | grep compute)","Check the GCE service account has roles/compute.networkAdmin or at least compute.routers.create permission","Confirm the cluster spec's region/network/subnet names are correct and exist in the project","Retry the `kops update cluster` apply if the underlying error was transient (rate limit / backend error)"],"exampleFix":"// before (transient API failures abort the apply)\nop, err := t.Cloud.Compute().Routers().Insert(project, region, router)\nif err != nil {\n    return fmt.Errorf(\"error creating Router: %w\", err)\n}\n// after (retry transient errors with backoff before giving up)\nop, err := t.Cloud.Compute().Routers().Insert(project, region, router)\nif err != nil {\n    if gce.IsRetryable(err) {\n        return fi.NewRetryableError(fmt.Errorf(\"error creating Router: %w\", err))\n    }\n    return fmt.Errorf(\"error creating Router: %w\", err)\n}","handlingStrategy":"try-catch","validationCode":"// Pre-check before apply\nif err := checkComputeAPIEnabled(projectID); err != nil { return err }\nif _, err := compute.Routers.List(projectID, region).Do(); err != nil {\n    return fmt.Errorf(\"cannot access Routers API in %s: %w\", region, err)\n}","typeGuard":"func isPermissionDenied(err error) bool {\n    var ge *googleapi.Error\n    return errors.As(err, &ge) && (ge.Code == 403 || ge.Code == 401)\n}","tryCatchPattern":"op, err := cloud.Compute().Routers().Insert(project, region, router)\nif err != nil {\n    var ge *googleapi.Error\n    if errors.As(err, &ge) && ge.Code == 403 {\n        return fmt.Errorf(\"missing compute.routers.create permission: %w\", err)\n    }\n    return fmt.Errorf(\"error creating Router: %w\", err)\n}\nif err := cloud.WaitForOp(op); err != nil {\n    return fmt.Errorf(\"error waiting for router creation: %w\", err)\n}","preventionTips":["Enable the Compute Engine API in the project before running kops","Grant the kOps service account compute.networkAdmin","Validate region/network/subnet names in the cluster spec before apply","Retry applies on transient Google API 5xx errors"],"tags":["gce","networking","router","api-error"],"backgroundTag":"gcp-api-request-failed","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T12:17:11.808Z"}