{"record":{"id":"f62f19a2fb37091f","repo":"kubernetes/kops","slug":"error-listing-firewallrules-v","errorCode":null,"errorMessage":"error listing FirewallRules: %v","messagePattern":"error listing FirewallRules: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/resources/gce/gce.go","lineNumber":528,"sourceCode":"\t\t\treturn nil\n\t\t}\n\t\treturn fmt.Errorf(\"error deleting ForwardingRule %s: %v\", t.SelfLink, err)\n\t}\n\n\treturn c.WaitForOp(op)\n}\n\n// listFirewallRules discovers Firewall objects for the cluster\nfunc (d *clusterDiscoveryGCE) listFirewallRules() ([]*resources.Resource, error) {\n\tc := d.gceCloud\n\n\tvar resourceTrackers []*resources.Resource\n\n\tctx := context.Background()\n\n\tfirewallRules, err := c.Compute().Firewalls().List(ctx, c.Project())\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"error listing FirewallRules: %v\", err)\n\t}\n\nnextFirewallRule:\n\tfor _, firewallRule := range firewallRules {\n\t\tif !d.matchesClusterNameMultipart(firewallRule.Name, maxPrefixTokens) && !strings.HasPrefix(firewallRule.Name, \"k8s-\") {\n\t\t\tcontinue\n\t\t}\n\n\t\t// TODO: Check network?  (or other fields?)  No label support currently.\n\n\t\t// We consider only firewall rules that target our cluster tags, which include the cluster name or hash\n\t\ttagPrefix := gce.SafeClusterName(d.clusterName) + \"-\"\n\t\tclusterNameHash := truncate.HashString(gce.SafeClusterName(d.clusterName), 6)\n\t\tif len(firewallRule.TargetTags) != 0 {\n\t\t\ttagMatchCount := 0\n\t\t\tfor _, target := range firewallRule.TargetTags {\n\t\t\t\tif strings.HasPrefix(target, tagPrefix) || strings.Contains(target, clusterNameHash) {\n\t\t\t\t\ttagMatchCount++","sourceCodeStart":510,"sourceCodeEnd":546,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/pkg/resources/gce/gce.go#L510-L546","documentation":"listFirewallRules wraps the Compute Firewalls.List failure while discovering cluster firewall rules by name prefix/labels. It fires on GCE API errors (auth, disabled API); this path is also exercised by TestListFirewallRulesLoadBalancer.","triggerScenarios":"Thrown at pkg/resources/gce/gce.go:528 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Check GCP credentials and compute.firewalls.list permission","Retry after transient API errors","Verify the project is correct and accessible"],"exampleFix":null,"handlingStrategy":"retry","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T07:17:12.445Z"}