{"record":{"id":"f38b620739d2889b","repo":"kubernetes/kops","slug":"error-fetching-network-q-w","errorCode":null,"errorMessage":"error fetching network %q: %w","messagePattern":"error fetching network %q: %w","errorType":"error_code","errorClass":null,"httpStatus":null,"severity":"error","filePath":"upup/pkg/fi/cloudup/gce/network.go","lineNumber":99,"sourceCode":"\tif networkName == \"\" {\n\t\tnetworkName = SafeClusterName(c.Name)\n\t}\n\n\tcloud := cloudObj.(GCECloud)\n\tnetworkName, projectName, err := ParseNameAndProjectFromNetworkID(networkName)\n\tif err != nil {\n\t\treturn nil, err\n\t}\n\tif projectName == \"\" {\n\t\tprojectName = cloud.Project()\n\t}\n\n\tnetwork, err := cloud.Compute().Networks().Get(projectName, networkName)\n\tif err != nil {\n\t\tif IsNotFound(err) {\n\t\t\tnetwork = nil\n\t\t} else {\n\t\t\treturn nil, fmt.Errorf(\"error fetching network %q: %w\", networkName, err)\n\t\t}\n\t}\n\tused := &subnet.CIDRMap{}\n\n\tif network == nil {\n\t\treturn used, nil\n\t}\n\n\tsubnetURLs := make(map[string]bool)\n\tfor _, subnet := range network.Subnetworks {\n\t\tsubnetURLs[subnet] = true\n\t}\n\tif len(subnetURLs) == 0 {\n\t\treturn used, nil\n\t}\n\n\tklog.Infof(\"scanning regions for subnetwork CIDR allocations\")\n","sourceCodeStart":81,"sourceCodeEnd":117,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/upup/pkg/fi/cloudup/gce/network.go#L81-L117","documentation":"buildUsed fetches the GCE network via Networks().Get to compute used CIDR space during subnet/IP-alias assignments. If the API returns an error that is not a NotFound (which is tolerated as network=nil), it is wrapped in this error. It indicates a transient or permission-related failure to read the network, not a missing network.","triggerScenarios":"Cloud Compute API outage or rate limiting (429/5xx) during Networks().Get; the credentials/service account lacking compute.networks.get permission on the (possibly cross-project) network; networkID pointing at a project the caller cannot access.","commonSituations":"Cross-project network shared via Shared VPC where the kops service account lacks access; GCP API quota exhaustion during a large update; transient API errors during cluster create/update.","solutions":["Retry the kops command — most underlying errors are transient API failures","Verify the service account has compute.networks.get (roles/compute.networkViewer or Compute Viewer) on the project owning the network","If using a cross-project networkID, confirm the project ID is correct and Shared VPC access is configured","Check GCP status / quota for the Compute API in the project"],"exampleFix":null,"handlingStrategy":"retry","validationCode":"// pre-check IAM before running kops\n// gcloud projects get-iam-policy PROJECT --flatten=\"bindings[].members\" --filter=\"bindings.role=roles/compute.networkViewer\"","typeGuard":null,"tryCatchPattern":"_, err := buildUsed(ctx, cluster, cloud)\nif err != nil && strings.Contains(err.Error(), \"error fetching network\") {\n\t// distinguish transient vs permission: inspect wrapped googleapi.Error\n\tvar gerr *googleapi.Error\n\tif errors.As(err, &gerr) && (gerr.Code == 429 || gerr.Code >= 500) {\n\t\t// safe to retry with backoff\n\t}\n\treturn err\n}","preventionTips":["Grant the kops service account compute.networks.get (Compute Network Viewer) on the network's project","Configure Shared VPC correctly when using cross-project network IDs","Add exponential backoff around kops update runs that hit the Compute API","Monitor GCP quota usage for the Compute API in the project"],"tags":["gce","network","gcp-api","permissions"],"backgroundTag":"gcp-api-permission-denied","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T12:17:11.808Z"}