kubernetes/kops · error

error building IAM API client: %v

Error message

error building IAM API client: %v

What it means

NewGCECloud wraps newIamClientImpl failure while building the Google IAM API client (service-account/key operations). Same credential-resolution failure mode as the other clients; construction aborts because IAM is required for cluster lifecycle operations.

Source

Thrown at upup/pkg/fi/cloudup/gce/gce_cloud.go:156

	if os.Getenv("GOOGLE_APPLICATION_CREDENTIALS") != "" {
		klog.Infof("Will load GOOGLE_APPLICATION_CREDENTIALS from %s", os.Getenv("GOOGLE_APPLICATION_CREDENTIALS"))
	}

	computeClient, err := newComputeClientImpl(ctx)
	if err != nil {
		return nil, fmt.Errorf("error building compute API client: %v", err)
	}
	c.compute = computeClient

	storageClient, err := storage.NewClient(ctx)
	if err != nil {
		return nil, fmt.Errorf("error building storage API client: %v", err)
	}
	c.storage = storageClient

	iamService, err := newIamClientImpl(ctx)
	if err != nil {
		return nil, fmt.Errorf("error building IAM API client: %v", err)
	}
	c.iam = iamService

	dnsClient, err := newDNSClientImpl(ctx)
	if err != nil {
		return nil, fmt.Errorf("error building DNS API client: %v", err)
	}
	c.dns = dnsClient

	cloudResourceManager, err := cloudresourcemanager.NewService(ctx)
	if err != nil {
		return nil, fmt.Errorf("error building cloudresourcemanager API client: %w", err)
	}
	c.cloudResourceManager = cloudResourceManager

	CacheGCECloudInstance(region, project, c)

	{

View on GitHub (pinned to 4c8573c808)

Solutions

1. Fix Application Default Credentials
2. Verify IAM API is enabled on the project
3. Check the wrapped error

When it happens

Trigger: Thrown at upup/pkg/fi/cloudup/gce/gce_cloud.go:156 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/43c8f0134ff4f93e. Report an issue: GitHub.