{"record":{"id":"d419cbab65a25afd","repo":"kubernetes/kops","slug":"error-building-iam-api-client-v-d419cb","errorCode":null,"errorMessage":"error building iam API client: %v","messagePattern":"error building iam API client: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"upup/pkg/fi/cloudup/gce/iam.go","lineNumber":39,"sourceCode":"\t\"fmt\"\n\n\t\"google.golang.org/api/iam/v1\"\n)\n\ntype IamClient interface {\n\tServiceAccounts() ServiceAccountClient\n}\n\ntype iamClientImpl struct {\n\tsrv *iam.Service\n}\n\nvar _ IamClient = (*iamClientImpl)(nil)\n\nfunc newIamClientImpl(ctx context.Context) (*iamClientImpl, error) {\n\tsrv, err := iam.NewService(ctx)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"error building iam API client: %v\", err)\n\t}\n\treturn &iamClientImpl{\n\t\tsrv: srv,\n\t}, nil\n}\n\nfunc (i *iamClientImpl) ServiceAccounts() ServiceAccountClient {\n\treturn &serviceAccountClientImpl{\n\t\tsrv: i.srv.Projects.ServiceAccounts,\n\t}\n}\n\ntype ServiceAccountClient interface {\n\tGet(ctx context.Context, fqn string) (*iam.ServiceAccount, error)\n\tCreate(ctx context.Context, project string, req *iam.CreateServiceAccountRequest) (*iam.ServiceAccount, error)\n\tUpdate(ctx context.Context, fqn string, sa *iam.ServiceAccount) (*iam.ServiceAccount, error)\n\tDelete(saName string) (*iam.Empty, error)\n\tList(ctx context.Context, project string) ([]*iam.ServiceAccount, error)","sourceCodeStart":21,"sourceCodeEnd":57,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/upup/pkg/fi/cloudup/gce/iam.go#L21-L57","documentation":"newIamClientImpl builds the Google IAM API service client (iam.NewService). This error wraps any failure from constructing that client, which almost always means the underlying google HTTP client/options could not be created — typically an authentication or transport initialization problem — so the GCE cloud provider cannot manage IAM roles/bindings.","triggerScenarios":"Calling NewGCECloud where iam.NewService(ctx) fails: no valid credentials (missing/invalid GOOGLE_APPLICATION_CREDENTIALS), unreadable service-account key file, malformed key JSON, or failure creating the shared HTTP client (bad proxy env, TLS config, option errors).","commonSituations":"kops controller or CLI running on a GCE machine / locally without gcloud application-default credentials, a rotated or deleted service-account key, or an incorrect GOOGLE_APPLICATION_CREDENTIALS path.","solutions":["Set GOOGLE_APPLICATION_CREDENTIALS to a valid service-account JSON key, or run `gcloud auth application-default login` locally.","Verify the key file exists, is readable, and is valid JSON with a private_key.","Re-create the key if the service-account key was revoked or rotated.","Check http_proxy/HTTPS_PROXY and network reachability to googleapis.com if transport setup fails."],"exampleFix":"// before (shell)\nkops create cluster ...\n// after (shell)\nexport GOOGLE_APPLICATION_CREDENTIALS=/path/to/service-account.json\nkops create cluster ...","handlingStrategy":"fallback","validationCode":"// verify credentials exist before creating the cloud client\ncreds := os.Getenv(\"GOOGLE_APPLICATION_CREDENTIALS\")\nif creds == \"\" {\n\tif _, err := google.FindDefaultCredentials(ctx); err != nil {\n\t\treturn fmt.Errorf(\"no GCP credentials: run 'gcloud auth application-default login' or set GOOGLE_APPLICATION_CREDENTIALS\")\n\t}\n} else if _, err := os.Stat(creds); err != nil {\n\treturn fmt.Errorf(\"GOOGLE_APPLICATION_CREDENTIALS file not readable: %v\", err)\n}","typeGuard":null,"tryCatchPattern":"cloud, err := gce.NewGCECloud(...)\nif err != nil && strings.Contains(err.Error(), \"error building iam API client\") {\n\t// surface credential guidance to the operator\n\treturn fmt.Errorf(\"GCP IAM client init failed; check GOOGLE_APPLICATION_CREDENTIALS / ADC: %w\", err)\n}","preventionTips":["Validate ADC/service-account keys in CI before deploying.","Monitor service-account key rotation and update key files promptly.","Prefer workload identity / attached service accounts over exported key files."],"tags":["gce","iam","authentication","api-client"],"backgroundTag":"missing-credentials","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T07:17:12.445Z"}