kubernetes/kops · error

error checking IAM for project %s: %w

Error message

error checking IAM for project %s: %w

What it means

Wrapped error from ProjectIAMBinding.Find when CloudResourceManager Projects.GetIamPolicy fails while checking whether the member already holds the role. Causes include missing resourcemanager.projects.getIamPolicy permission, an invalid project ID, or API errors.

Source

Thrown at upup/pkg/fi/cloudup/gcetasks/projectiambinding.go:64

}

func (e *ProjectIAMBinding) Find(c *fi.CloudupContext) (*ProjectIAMBinding, error) {
	ctx := context.TODO()

	cloud := c.T.Cloud.(gce.GCECloud)

	projectID := fi.ValueOf(e.Project)
	member := "serviceAccount:" + fi.ValueOf(e.MemberServiceAccount.Email)
	role := fi.ValueOf(e.Role)

	klog.V(2).Infof("Checking IAM for project %q", projectID)
	options := &cloudresourcemanager.GetIamPolicyRequest{Options: &cloudresourcemanager.GetPolicyOptions{RequestedPolicyVersion: 3}}
	policy, err := cloud.CloudResourceManager().Projects.GetIamPolicy(projectID, options).Context(ctx).Do()
	if err != nil {
		if gce.IsNotFound(err) {
			return nil, nil
		}
		return nil, fmt.Errorf("error checking IAM for project %s: %w", projectID, err)
	}

	changed := patchCRMPolicy(policy, member, role)
	if changed {
		return nil, nil
	}

	actual := &ProjectIAMBinding{}
	actual.Project = e.Project
	actual.MemberServiceAccount = e.MemberServiceAccount
	actual.Role = e.Role

	// Ignore "system" fields
	actual.Name = e.Name
	actual.Lifecycle = e.Lifecycle

	return actual, nil
}

View on GitHub (pinned to 4c8573c808)

Solutions

1. Check the wrapped error for the API reason
2. Verify the project ID and the service account's CRM permissions
3. Retry on transient Cloud Resource Manager failures

When it happens

Trigger: Thrown at upup/pkg/fi/cloudup/gcetasks/projectiambinding.go:64 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/3111b03d36da4861. Report an issue: GitHub.