kubernetes/kops · error

error creating FirewallRule: %v

Error message

error creating FirewallRule: %v

What it means

RenderGCE calls Compute().Firewalls().Insert() when the firewall rule does not yet exist in GCE. If the Insert API call fails, the raw Google API error is wrapped as 'error creating FirewallRule: %v'. This is a cloud-side failure, not a spec validation problem.

Source

Thrown at upup/pkg/fi/cloudup/gcetasks/firewallrule.go:215

		SourceRanges: e.SourceRanges,
		TargetTags:   e.TargetTags,
		Allowed:      allowed,
		Disabled:     e.Disabled,
	}
	return firewall, nil
}

func (_ *FirewallRule) RenderGCE(t *gce.GCEAPITarget, a, e, changes *FirewallRule) error {
	cloud := t.Cloud
	firewall, err := e.mapToGCE(cloud.Project())
	if err != nil {
		return err
	}

	if a == nil {
		_, err := t.Cloud.Compute().Firewalls().Insert(t.Cloud.Project(), firewall)
		if err != nil {
			return fmt.Errorf("error creating FirewallRule: %v", err)
		}
	} else {
		_, err := t.Cloud.Compute().Firewalls().Update(t.Cloud.Project(), *e.Name, firewall)
		if err != nil {
			return fmt.Errorf("error creating FirewallRule: %v", err)
		}
	}

	return nil
}

type terraformAllow struct {
	Protocol string   `cty:"protocol"`
	Ports    []string `cty:"ports"`
}

type terraformFirewall struct {
	Name    string                   `cty:"name"`

View on GitHub (pinned to 4c8573c808)

Solutions

1. Read the wrapped %v detail to identify the underlying Google API error and fix its cause.
2. Check firewall quota in the GCE console and delete unused rules or request an increase.
3. Verify the service account has compute.firewalls.create permission (roles/compute.networkAdmin or similar).
4. Confirm the network/project fields resolve to existing resources, then re-run kops update.

// pre-checks before apply:
// gcloud compute project-info describe --format="value(quotas)"
// gcloud projects get-iam-policy PROJECT  # confirm compute.firewalls.create

if err := kopsUpdate(); err != nil {
  var gerr *googleapi.Error
  if errors.As(err, &gerr) {
    switch gerr.Code {
    case 403:
      log.Fatal("IAM missing compute.firewalls.create; grant roles/compute.networkAdmin")
    case 429:
      time.Sleep(backoff); retry()
    default:
      log.Fatalf("firewall create failed: %v", err)
    }
  }
}

When it happens

Trigger: First-time creation of a firewall rule where the Compute API Insert call returns an error: quota exceeded, permission denied, invalid network URL, or transient API failure.

Common situations: Exceeded GCE firewall quota (default ~256 rules per network); service account missing compute.firewalls.create IAM role; referencing a network that does not exist; regional API outage.

Related errors

• error getting ForwardingRule %q: %v
• error fetching GCE instance: %w
• error fetching GCE instance group template %q: %v
• error fetching GCE managed instance group %q: %v
• error getting ForwardingRule %q: %w

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/c733b6330169a9cb. Report an issue: GitHub.