{"record":{"id":"c733b6330169a9cb","repo":"kubernetes/kops","slug":"error-creating-firewallrule-v","errorCode":null,"errorMessage":"error creating FirewallRule: %v","messagePattern":"error creating FirewallRule: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"upup/pkg/fi/cloudup/gcetasks/firewallrule.go","lineNumber":215,"sourceCode":"\t\tSourceRanges: e.SourceRanges,\n\t\tTargetTags:   e.TargetTags,\n\t\tAllowed:      allowed,\n\t\tDisabled:     e.Disabled,\n\t}\n\treturn firewall, nil\n}\n\nfunc (_ *FirewallRule) RenderGCE(t *gce.GCEAPITarget, a, e, changes *FirewallRule) error {\n\tcloud := t.Cloud\n\tfirewall, err := e.mapToGCE(cloud.Project())\n\tif err != nil {\n\t\treturn err\n\t}\n\n\tif a == nil {\n\t\t_, err := t.Cloud.Compute().Firewalls().Insert(t.Cloud.Project(), firewall)\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"error creating FirewallRule: %v\", err)\n\t\t}\n\t} else {\n\t\t_, err := t.Cloud.Compute().Firewalls().Update(t.Cloud.Project(), *e.Name, firewall)\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"error creating FirewallRule: %v\", err)\n\t\t}\n\t}\n\n\treturn nil\n}\n\ntype terraformAllow struct {\n\tProtocol string   `cty:\"protocol\"`\n\tPorts    []string `cty:\"ports\"`\n}\n\ntype terraformFirewall struct {\n\tName    string                   `cty:\"name\"`","sourceCodeStart":197,"sourceCodeEnd":233,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/upup/pkg/fi/cloudup/gcetasks/firewallrule.go#L197-L233","documentation":"RenderGCE calls Compute().Firewalls().Insert() when the firewall rule does not yet exist in GCE. If the Insert API call fails, the raw Google API error is wrapped as 'error creating FirewallRule: %v'. This is a cloud-side failure, not a spec validation problem.","triggerScenarios":"First-time creation of a firewall rule where the Compute API Insert call returns an error: quota exceeded, permission denied, invalid network URL, or transient API failure.","commonSituations":"Exceeded GCE firewall quota (default ~256 rules per network); service account missing compute.firewalls.create IAM role; referencing a network that does not exist; regional API outage.","solutions":["Read the wrapped %v detail to identify the underlying Google API error and fix its cause.","Check firewall quota in the GCE console and delete unused rules or request an increase.","Verify the service account has compute.firewalls.create permission (roles/compute.networkAdmin or similar).","Confirm the network/project fields resolve to existing resources, then re-run kops update."],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":"// pre-checks before apply:\n// gcloud compute project-info describe --format=\"value(quotas)\"\n// gcloud projects get-iam-policy PROJECT  # confirm compute.firewalls.create","typeGuard":null,"tryCatchPattern":"if err := kopsUpdate(); err != nil {\n  var gerr *googleapi.Error\n  if errors.As(err, &gerr) {\n    switch gerr.Code {\n    case 403:\n      log.Fatal(\"IAM missing compute.firewalls.create; grant roles/compute.networkAdmin\")\n    case 429:\n      time.Sleep(backoff); retry()\n    default:\n      log.Fatalf(\"firewall create failed: %v\", err)\n    }\n  }\n}","preventionTips":["Monitor GCE firewall rule quota before large applies.","Grant the kops service account roles/compute.networkAdmin.","Verify referenced networks exist before applying."],"tags":["gce","firewall","api-error","cloud"],"backgroundTag":"gcp-api-insert-failed","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T07:17:12.445Z"}