{"record":{"id":"e7fe4f0b11b8c945","repo":"VictoriaMetrics/VictoriaMetrics","slug":"cannot-query-q-w","errorCode":null,"errorMessage":"cannot query %q: %w","messagePattern":"cannot query %q: %w","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"lib/promscrape/discovery/gce/api.go","lineNumber":96,"sourceCode":"\tif sdc.Port != nil {\n\t\tport = *sdc.Port\n\t}\n\treturn &apiConfig{\n\t\tclient:       client,\n\t\tzones:        zones,\n\t\tproject:      project,\n\t\tfilter:       sdc.Filter,\n\t\ttagSeparator: tagSeparator,\n\t\tport:         port,\n\t}, nil\n}\n\nfunc getAPIResponse(client *http.Client, apiURL, filter, pageToken string) ([]byte, error) {\n\tapiURL = appendNonEmptyQueryArg(apiURL, \"filter\", filter)\n\tapiURL = appendNonEmptyQueryArg(apiURL, \"pageToken\", pageToken)\n\tresp, err := client.Get(apiURL)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"cannot query %q: %w\", apiURL, err)\n\t}\n\treturn readResponseBody(resp, apiURL)\n}\n\nfunc readResponseBody(resp *http.Response, apiURL string) ([]byte, error) {\n\tdata, err := io.ReadAll(resp.Body)\n\t_ = resp.Body.Close()\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"cannot read response from %q: %w\", apiURL, err)\n\t}\n\tif resp.StatusCode != http.StatusOK {\n\t\treturn nil, fmt.Errorf(\"unexpected status code for %q; got %d; want %d; response body: %q\",\n\t\t\tapiURL, resp.StatusCode, http.StatusOK, data)\n\t}\n\treturn data, nil\n}\n\nfunc appendNonEmptyQueryArg(apiURL, argName, argValue string) string {","sourceCodeStart":78,"sourceCodeEnd":114,"githubUrl":"https://github.com/VictoriaMetrics/VictoriaMetrics/blob/5079fb58f1e8e62113f90c945ad71586c797d770/lib/promscrape/discovery/gce/api.go#L78-L114","documentation":"getAPIResponse performs a plain client.Get(apiURL) against the GCE Compute API (with filter and pageToken query args). If the HTTP request itself fails — DNS failure, TLS error, connection refused/timeout — the URL is wrapped in this message. This fires before any response-body reading, so it signals transport-level failure, not an API error status.","triggerScenarios":"getInstancesForProjectAndZone or getZonesForProject calling getAPIResponse when the GET to compute.googleapis.com fails at the transport layer: no network egress, DNS resolution failure for compute.googleapis.com, TLS interception with untrusted CA, or socket timeout on large page requests.","commonSituations":"Air-gapped/VPC without internet egress or without Private Google Access; corporate proxy MITM breaking TLS; DNS misconfiguration in containers; transient network blips during paged listing.","solutions":["Test connectivity from the vmagent host: curl -v https://compute.googleapis.com/compute/v1/projects/<project>/zones.","Enable Private Google Access or a NAT/proxy if the host has no internet egress.","If using a TLS-intercepting proxy, add the corporate CA to the system trust store.","Fix DNS resolution of compute.googleapis.com (check /etc/resolv.conf, CoreDNS) and retry on transient failures."],"exampleFix":"// before\n# VPC without egress to googleapis.com -> connection timeout\n// after\n# enable Private Google Access on the subnet, or configure HTTPS_PROXY:\n$ export HTTPS_PROXY=http://proxy.corp:3128","handlingStrategy":"retry","validationCode":"ctx, cancel := context.WithTimeout(context.Background(), 10*time.Second)\ndefer cancel()\nreq, _ := http.NewRequestWithContext(ctx, 'GET', apiURL, nil)\nif _, err := http.DefaultClient.Do(req); err != nil {\n    return fmt.Errorf('GCE API unreachable before SD start: %w', err)\n}","typeGuard":null,"tryCatchPattern":"data, err := getAPIResponse(client, apiURL, filter, token)\nif err != nil {\n    // transport failure: retry with backoff; pageToken makes retries safe\n    time.Sleep(backoff)\n    data, err = getAPIResponse(client, apiURL, filter, token)\n}","preventionTips":["Ensure network egress to compute.googleapis.com:443 (or Private Google Access)","Trust the corporate TLS CA if traffic is intercepted","Fix DNS for compute.googleapis.com in containerized environments","Apply retries with backoff — paged listing is idempotent via pageToken"],"tags":["network","http-client","gce","google-cloud","dns"],"backgroundTag":"network-request-failed","analyzedSha":"5079fb58f1e8e62113f90c945ad71586c797d770","analyzedAt":"2026-09-03T18:10:26.153Z","contentChangedAt":"2026-09-03T18:10:26.153Z","schemaVersion":2},"datasetVersion":"2026-09-08T15:18:49.778Z"}