kubernetes/kops · error

error building iam API client: %v

Error message

error building iam API client: %v

What it means

newIamClientImpl builds the Google IAM API service client (iam.NewService). This error wraps any failure from constructing that client, which almost always means the underlying google HTTP client/options could not be created — typically an authentication or transport initialization problem — so the GCE cloud provider cannot manage IAM roles/bindings.

Source

Thrown at upup/pkg/fi/cloudup/gce/iam.go:39

	"fmt"

	"google.golang.org/api/iam/v1"
)

type IamClient interface {
	ServiceAccounts() ServiceAccountClient
}

type iamClientImpl struct {
	srv *iam.Service
}

var _ IamClient = (*iamClientImpl)(nil)

func newIamClientImpl(ctx context.Context) (*iamClientImpl, error) {
	srv, err := iam.NewService(ctx)
	if err != nil {
		return nil, fmt.Errorf("error building iam API client: %v", err)
	}
	return &iamClientImpl{
		srv: srv,
	}, nil
}

func (i *iamClientImpl) ServiceAccounts() ServiceAccountClient {
	return &serviceAccountClientImpl{
		srv: i.srv.Projects.ServiceAccounts,
	}
}

type ServiceAccountClient interface {
	Get(ctx context.Context, fqn string) (*iam.ServiceAccount, error)
	Create(ctx context.Context, project string, req *iam.CreateServiceAccountRequest) (*iam.ServiceAccount, error)
	Update(ctx context.Context, fqn string, sa *iam.ServiceAccount) (*iam.ServiceAccount, error)
	Delete(saName string) (*iam.Empty, error)
	List(ctx context.Context, project string) ([]*iam.ServiceAccount, error)

View on GitHub (pinned to 4c8573c808)

Solutions

1. Set GOOGLE_APPLICATION_CREDENTIALS to a valid service-account JSON key, or run `gcloud auth application-default login` locally.
2. Verify the key file exists, is readable, and is valid JSON with a private_key.
3. Re-create the key if the service-account key was revoked or rotated.
4. Check http_proxy/HTTPS_PROXY and network reachability to googleapis.com if transport setup fails.

Example fix

// before (shell)
kops create cluster ...
// after (shell)
export GOOGLE_APPLICATION_CREDENTIALS=/path/to/service-account.json
kops create cluster ...

// verify credentials exist before creating the cloud client
creds := os.Getenv("GOOGLE_APPLICATION_CREDENTIALS")
if creds == "" {
	if _, err := google.FindDefaultCredentials(ctx); err != nil {
		return fmt.Errorf("no GCP credentials: run 'gcloud auth application-default login' or set GOOGLE_APPLICATION_CREDENTIALS")
	}
} else if _, err := os.Stat(creds); err != nil {
	return fmt.Errorf("GOOGLE_APPLICATION_CREDENTIALS file not readable: %v", err)
}

cloud, err := gce.NewGCECloud(...)
if err != nil && strings.Contains(err.Error(), "error building iam API client") {
	// surface credential guidance to the operator
	return fmt.Errorf("GCP IAM client init failed; check GOOGLE_APPLICATION_CREDENTIALS / ADC: %w", err)
}

When it happens

Trigger: Calling NewGCECloud where iam.NewService(ctx) fails: no valid credentials (missing/invalid GOOGLE_APPLICATION_CREDENTIALS), unreadable service-account key file, malformed key JSON, or failure creating the shared HTTP client (bad proxy env, TLS config, option errors).

Common situations: kops controller or CLI running on a GCE machine / locally without gcloud application-default credentials, a rotated or deleted service-account key, or an incorrect GOOGLE_APPLICATION_CREDENTIALS path.

Related errors

• error fetching GCE instance: %w
• error listing zones: %v
• error listing ServiceAccounts %w
• Invalid service account email '%s'
• error deleting ServiceAccount %s: %v

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/d419cbab65a25afd. Report an issue: GitHub.