kubernetes/kops · error

deleting forwardingRule %s: %w

Error message

deleting forwardingRule %s: %w

What it means

This wraps the error returned by the GCE Compute API call ForwardingRules().Delete(ctx, project, region, name) during deletion of a regional forwarding rule. The %w wrapping preserves the underlying googleapi error (404, 4xx/5xx, quota, permission) for errors.Is/As inspection.

Source

Thrown at upup/pkg/fi/cloudup/gcetasks/forwardingrule.go:404

// Item returns the forwarding rule name
func (d *deleteForwardingRule) Item() string {
	return d.forwardingRule.Name
}

func (d *deleteForwardingRule) Delete(t fi.CloudupTarget) error {
	ctx := context.TODO()

	gceTarget, ok := t.(*gce.GCEAPITarget)
	if !ok {
		return fmt.Errorf("unexpected target type for deletion: %T", t)
	}

	cloud := gceTarget.Cloud
	name := d.forwardingRule.Name

	if _, err := cloud.Compute().ForwardingRules().Delete(ctx, cloud.Project(), cloud.Region(), name); err != nil {
		return fmt.Errorf("deleting forwardingRule %s: %w", name, err)
	}

	return nil
}

// String returns a string representation of the task
func (d *deleteForwardingRule) String() string {
	return d.TaskName() + "-" + d.Item()
}

func (d *deleteForwardingRule) DeferDeletion() bool {
	// We want to defer deletion, in case new nodes are launched with
	// the old configuration during the rolling-update operation.
	return true
}

View on GitHub (pinned to 4c8573c808)

Solutions

1. Read the wrapped googleapi error (errors.As to *googleapi.Error) and act on its code (403 => IAM, 429 => retry, 404 => already gone)
2. Verify the service account has compute.forwardingRules.delete (e.g. roles/compute.networkAdmin)
3. Retry after backoff for transient 5xx/429; re-run kops delete/apply since deletion is idempotent
4. Ensure the rule's region matches cloud.Region() used by the cluster

Example fix

null

// pre-check IAM and resource existence before delete
_, err := cloud.Compute().ForwardingRules().Get(ctx, cloud.Project(), cloud.Region(), name)
if gce.IsNotFound(err) { return nil } // nothing to delete

var gerr *googleapi.Error
if errors.As(err, &gerr) {
	switch gerr.Code {
	case 404: // already deleted, ignore
	case 403: // fix IAM: compute.forwardingRules.delete
	case 429, 500, 503: // retry with backoff
	}
}

When it happens

Trigger: cloud.Compute().ForwardingRules().Delete fails for the named regional forwarding rule — network error, expired/insufficient credentials, missing compute.forwardingRules.delete permission, rate limiting, or the rule being in a state that forbids deletion.

Common situations: Service account lacks compute.forwardingRules.delete IAM permission; GCE API transient 500/503; forwarding rule still attached to a target pool/proxy during teardown; regional mismatch between the task and the actual rule location.

Related errors

• error deleting Subnetwork %s: %v
• error deleting router %s: %v
• listing forwardingRules: %w
• error finding CloudInstanceGroups: %v
• error listing routers: %v

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/8b9b8c0d950b1f65. Report an issue: GitHub.