{"record":{"id":"ee4ad53318368868","repo":"kubernetes/kops","slug":"serviceaccount-with-email-q-not-found","errorCode":null,"errorMessage":"ServiceAccount with email %q not found","messagePattern":"ServiceAccount with email %q not found","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"upup/pkg/fi/cloudup/gcetasks/serviceaccount.go","lineNumber":112,"sourceCode":"\treturn fi.CloudupDefaultDeltaRunMethod(e, c)\n}\n\nfunc (_ *ServiceAccount) CheckChanges(a, e, changes *ServiceAccount) error {\n\treturn nil\n}\n\nfunc (_ *ServiceAccount) RenderGCE(t *gce.GCEAPITarget, a, e, changes *ServiceAccount) error {\n\tctx := context.TODO()\n\n\tcloud := t.Cloud\n\n\temail := fi.ValueOf(e.Email)\n\n\tshared := fi.ValueOf(e.Shared)\n\tif shared {\n\t\t// Verify the service account was found\n\t\tif a == nil {\n\t\t\treturn fmt.Errorf(\"ServiceAccount with email %q not found\", email)\n\t\t}\n\t}\n\n\taccountID, projectID, err := gce.SplitServiceAccountEmail(email)\n\tif err != nil {\n\t\treturn err\n\t}\n\n\tfqn := \"projects/\" + projectID + \"/serviceAccounts/\" + email\n\n\tif a == nil {\n\t\tklog.V(2).Infof(\"Creating ServiceAccount %q\", fqn)\n\n\t\tsa := &iam.CreateServiceAccountRequest{\n\t\t\tAccountId: accountID,\n\t\t\tServiceAccount: &iam.ServiceAccount{\n\t\t\t\tDescription: fi.ValueOf(e.Description),\n\t\t\t\tDisplayName: fi.ValueOf(e.DisplayName),","sourceCodeStart":94,"sourceCodeEnd":130,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/upup/pkg/fi/cloudup/gcetasks/serviceaccount.go#L94-L130","documentation":"RenderGCE throws this when a GCE ServiceAccount task is marked Shared (i.e. kOps does not own or create the service account) but the Find phase returned no existing service account for the configured email. For shared accounts kOps must reuse a pre-existing account; creating it would be wrong, so the apply aborts. It means the cluster spec references a service account that does not exist in the target GCP project.","triggerScenarios":"Running `kops update cluster` against GCE where a ServiceAccount task has Shared=true and the email does not resolve to an existing IAM service account (Find returned nil, so `a == nil` in RenderGCE).","commonSituations":"Typo in the service account email in the cluster spec; the account was deleted in GCP after the cluster was created; cluster pointed at the wrong --project or wrong project inside the email (emails embed project ID via gce.SplitServiceAccountEmail); the account lives in a different project than the one kOps is authenticated against.","solutions":["Verify the service account exists: `gcloud iam service-accounts list --project=<project>` and compare with the Email in the cluster spec.","Fix a typo or wrong project ID in the service account email in the cluster spec, then re-run update.","Recreate the deleted service account (or change Shared to false so kOps creates and manages it).","Ensure kOps credentials target the project where the account actually lives (check GOOGLE_APPLICATION_CREDENTIALS / project flag)."],"exampleFix":"// cluster spec, before (account doesn't exist in project)\nsharedServiceAccount: shared@example-project.iam.gserviceaccount.com\n// after\ndev-robot@example-project.iam.gserviceaccount.com  // correct, existing account","handlingStrategy":"validation","validationCode":"sa := fi.ValueOf(e.Email)\nif fi.ValueOf(e.Shared) {\n    if _, err := exec.Command(\"gcloud\", \"iam\", \"service-accounts\", \"describe\", sa, \"--format=value(email)\").Output(); err != nil {\n        return fmt.Errorf(\"shared ServiceAccount %q does not exist in target project\", sa)\n    }\n}","typeGuard":"func sharedAccountFound(a *ServiceAccount, shared bool) bool { return !shared || a != nil }","tryCatchPattern":"if err := kopsUpdate(); err != nil {\n    if strings.Contains(err.Error(), \"ServiceAccount with email\") {\n        log.Printf(\"shared SA missing; create it with: gcloud iam service-accounts create <id> --project=<proj>\")\n    }\n    return err\n}","preventionTips":["Pre-create shared service accounts with gcloud/Terraform before `kops update cluster`.","Copy-paste the exact email from `gcloud iam service-accounts list` to avoid typos.","Pin the project in the spec and verify kOps authenticates to the same project.","Add a pre-flight script validating all shared:* resources exist."],"tags":["gce","gcp","iam","service-account","shared-resource"],"backgroundTag":"gcp-shared-service-account-not-found","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T07:17:12.445Z"}