{"record":{"id":"dae96e635ebcd021","repo":"kubernetes/kops","slug":"error-listing-zones-v","errorCode":null,"errorMessage":"error listing zones: %v","messagePattern":"error listing zones: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/resources/gce/gce.go","lineNumber":80,"sourceCode":"\nfunc ListResourcesGCE(gceCloud gce.GCECloud, clusterInfo resources.ClusterInfo) (map[string]*resources.Resource, error) {\n\tclusterName := clusterInfo.Name\n\n\tctx := context.TODO()\n\tregion := gceCloud.Region()\n\tallResources := make(map[string]*resources.Resource)\n\n\td := &clusterDiscoveryGCE{\n\t\tcloud:       gceCloud,\n\t\tgceCloud:    gceCloud,\n\t\tclusterName: clusterName,\n\t}\n\n\t{\n\t\t// TODO: Only zones in api.Cluster object, if we have one?\n\t\tgceZones, err := d.gceCloud.Compute().Zones().List(ctx, d.gceCloud.Project())\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"error listing zones: %v\", err)\n\t\t}\n\t\tfor _, gceZone := range gceZones {\n\t\t\tu, err := gce.ParseGoogleCloudURL(gceZone.Region)\n\t\t\tif err != nil {\n\t\t\t\treturn nil, err\n\t\t\t}\n\t\t\tif u.Name != region {\n\t\t\t\tcontinue\n\t\t\t}\n\t\t\td.zones = append(d.zones, gceZone.Name)\n\t\t}\n\t\tif len(d.zones) == 0 {\n\t\t\treturn nil, fmt.Errorf(\"unable to determine zones in region %q\", region)\n\t\t}\n\t\tklog.Infof(\"Scanning zones: %v\", d.zones)\n\t}\n\n\tlistFunctions := []gceListFn{","sourceCodeStart":62,"sourceCodeEnd":98,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/pkg/resources/gce/gce.go#L62-L98","documentation":"ListResourcesGCE lists all compute zones in the GCE project via the cloud provider's Compute().Zones().List call; any failure is wrapped as 'error listing zones: %v'. Zone discovery is the first step of GCE resource listing, so this failure aborts the entire listing operation.","triggerScenarios":"Zones().List(ctx, project) fails: invalid GCP credentials or missing compute scope on the service account, project ID wrong, Compute Engine API not enabled, quota/network errors, or expired gcloud auth (user ADC).","commonSituations":"Running 'kops toolbox dump'/'kops get' on a GCE cluster with GOOGLE_APPLICATION_CREDENTIALS pointing at a stale key, service account without compute.viewer role, or Compute API disabled in a brand-new project.","solutions":["Verify credentials: run 'gcloud compute zones list --project <project>' with the same identity kops uses; fix GOOGLE_APPLICATION_CREDENTIALS or 'gcloud auth application-default login' if it fails.","Enable the Compute Engine API for the project (gcloud services enable compute.googleapis.com).","Grant the service account roles/compute.viewer (at minimum compute.zones.list) on the project.","Confirm the project ID passed to kops matches an existing GCP project; check the wrapped error for 401/403/404 specifics."],"exampleFix":"// before\ngceZones, err := d.gceCloud.Compute().Zones().List(ctx, d.gceCloud.Project())\nif err != nil {\n\treturn nil, fmt.Errorf(\"error listing zones: %v\", err)\n}\n// after\ngceZones, err := d.gceCloud.Compute().Zones().List(ctx, d.gceCloud.Project())\nif err != nil {\n\treturn nil, fmt.Errorf(\"error listing zones in project %q: %w\", d.gceCloud.Project(), err)\n}","handlingStrategy":"try-catch","validationCode":"// preflight with gcloud using the same identity kops uses:\n// gcloud auth application-default print-access-token\n// gcloud compute zones list --project <project> --limit=1","typeGuard":"func hasComputeScope(creds *google.Credentials) bool {\n\tfor _, s := range creds.Scopes {\n\t\tif s == compute.CloudPlatformScope || s == compute.ComputeScope {\n\t\t\treturn true\n\t\t}\n\t}\n\treturn false\n}","tryCatchPattern":"gceZones, err := d.gceCloud.Compute().Zones().List(ctx, d.gceCloud.Project())\nif err != nil {\n\tvar eg *googleapi.Error\n\tif errors.As(err, &eg) {\n\t\tswitch eg.Code {\n\t\tcase http.StatusUnauthorized, http.StatusForbidden:\n\t\t\t// fix credentials / IAM roles\n\t\tcase http.StatusNotFound:\n\t\t\t// enable Compute Engine API or fix project ID\n\t\t}\n\t}\n\treturn nil, fmt.Errorf(\"error listing zones: %w\", err)\n}","preventionTips":["Keep GOOGLE_APPLICATION_CREDENTIALS pointed at a fresh, valid service-account key","Grant roles/compute.viewer to the service account","Enable the Compute Engine API in the target project","Periodically run 'gcloud compute zones list' as a connectivity/permission smoke test"],"tags":["gce","gcp","api","authentication"],"backgroundTag":"cloud-api-request-failed","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T07:17:12.445Z"}