kubernetes/kops · error

error creating forwarding rule

Error message

error creating forwarding rule: %v

What it means

The ForwardingRules.Insert API call succeeded, but the subsequent WaitForOp failed — the GCE operation to create the forwarding rule completed with an error. kOps reports it as 'error creating forwarding rule' with the operation's error embedded.

Solutions

1. Inspect the wrapped operation error for the operation-level cause
2. Re-run kops update — a failed create leaves no resource, so the next run retries the insert cleanly
3. Check GCE operation logs in Cloud Console (Compute Engine > Operations) for details
4. If timeouts recur, increase WaitForOp tolerance or investigate GCE service health

Example fix

null

null

if err := cloud.WaitForOp(op); err != nil {
    klog.Warningf("forwarding rule create op failed: %v; will retry on next run", err)
    return err // safe: insert is idempotent — next run recreates since no resource exists
}

When it happens

Trigger: Insert returned an operation, then t.Cloud.WaitForOp(op) returned non-nil because the operation finished with status DONE and an error (e.g. conditionNotMet, resource exhausted during provisioning).

Common situations: Concurrent modification of the same region by another controller; target pool/backend deleted between insert and completion; transient GCE service disruption; operation timeout if WaitForOp hits its deadline.

Related errors

• error creating ForwardingRule
• setting ForwardRule labels
• cannot apply changes to ForwardingRule
• deleting forwardingRule
• error creating Healthcheck

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/4b6805a9c0e9f4b6. Report an issue: GitHub.

Appendix: source

Thrown at upup/pkg/fi/cloudup/gcetasks/forwardingrule.go:234

	if e.Subnetwork != nil {
		project := t.Cloud.Project()
		if e.Network.Project != nil {
			project = *e.Network.Project
		}
		o.Subnetwork = e.Subnetwork.URL(project, t.Cloud.Region())
	}

	if a == nil {
		klog.V(4).Infof("Creating ForwardingRule %q", o.Name)

		op, err := t.Cloud.Compute().ForwardingRules().Insert(ctx, t.Cloud.Project(), t.Cloud.Region(), o)
		if err != nil {
			return fmt.Errorf("error creating ForwardingRule %q: %v", o.Name, err)
		}

		if err := t.Cloud.WaitForOp(op); err != nil {
			return fmt.Errorf("error creating forwarding rule: %v", err)
		}

		if e.Labels != nil {
			// We can't set labels on creation; we have to read the object to get the fingerprint
			// TODO: We could get it from the operation!
			r, err := t.Cloud.Compute().ForwardingRules().Get(ctx, t.Cloud.Project(), t.Cloud.Region(), name)
			if err != nil {
				return fmt.Errorf("reading created ForwardingRule %q: %v", name, err)
			}

			req := compute.RegionSetLabelsRequest{
				LabelFingerprint: r.LabelFingerprint,
				Labels:           e.Labels,
			}
			op, err := t.Cloud.Compute().ForwardingRules().SetLabels(ctx, t.Cloud.Project(), t.Cloud.Region(), o.Name, &req)
			if err != nil {
				return fmt.Errorf("setting ForwardingRule labels: %w", err)
			}

View on GitHub (pinned to 4c8573c808)