kubernetes/kops · error

cannot apply changes to healthcheck: %v

Error message

cannot apply changes to healthcheck: %v

What it means

RenderGCE only supports creating a new health check (a == nil). If the task runs with an existing health check that has changes (actual != nil but changes non-empty), there is no update implementation, so it refuses with this error rather than silently ignoring drift.

Source

Thrown at upup/pkg/fi/cloudup/gcetasks/healthcheck.go:159

		hc.Type = "TCP"
		hc.TcpHealthCheck = &compute.TCPHealthCheck{
			Port: e.Port,
		}
	}

	if a == nil {
		klog.V(2).Infof("Creating HealthCheck %q", hc.Name)

		op, err := cloud.Compute().RegionHealthChecks().Insert(cloud.Project(), cloud.Region(), hc)
		if err != nil {
			return fmt.Errorf("error creating healthcheck: %v", err)
		}

		if err := cloud.WaitForOp(op); err != nil {
			return fmt.Errorf("error waiting for healthcheck: %v", err)
		}
	} else {
		return fmt.Errorf("cannot apply changes to healthcheck: %v", changes)
	}

	return nil
}

type terraformHealthCheckBlock struct {
	Port int64 `cty:"port"`
}

type terraformHealthCheck struct {
	Name           string                     `cty:"name"`
	TCPHealthCheck *terraformHealthCheckBlock `cty:"tcp_health_check"`
	SSLHealthCheck *terraformHealthCheckBlock `cty:"ssl_health_check"`
}

func (_ *HealthCheck) RenderTerraform(t *terraform.TerraformTarget, a, e, changes *HealthCheck) error {
	tf := &terraformHealthCheck{
		Name: *e.Name,

View on GitHub (pinned to 4c8573c808)

Solutions

1. Delete the existing health check (or the resource that owns it, e.g. the backend service/target pool) and re-run apply so it is recreated with the new spec
2. Revert the cluster spec change so desired matches the existing health check
3. Implement/handle the update path (Patch/Update call) in the task if you own the code

Example fix

null

// detect drift before applying
actual, err := cloud.Compute().RegionHealthChecks().Get(cloud.Project(), cloud.Region(), *e.Name)
if err == nil && differs(actual, desired) { /* recreate or revert spec */ }

if err != nil && strings.HasPrefix(err.Error(), "cannot apply changes to healthcheck") {
	// fallback: delete the health check and re-apply to recreate it
}

When it happens

Trigger: An existing regional HealthCheck in GCE differs from the desired spec (e.g. changed port, check interval, or protocol in the cluster spec) and the apply attempts to apply those changes.

Common situations: Editing the kops cluster spec to modify an existing health check's parameters; drift introduced out-of-band in the GCE console; upgrading kops where a task's default health check fields changed.

Related errors

• error deleting HTTP HealthCheck %s: %v
• error listing Health Checks: %v
• error creating healthcheck: %v
• error waiting for healthcheck: %v
• cannot apply changes to InstanceGroupManager: %v

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/b3c5f09bc009cf4a. Report an issue: GitHub.