kubernetes/kops · error

error creating ForwardingRule %q: %v

Error message

error creating ForwardingRule %q: %v

What it means

Wraps the error returned by the Google Compute API ForwardingRules.Insert call when kOps attempts to create a new regional forwarding rule (no existing resource was found, a == nil). The underlying GCE error is embedded via %v, so the real cause (quota, invalid field, API error) is in the wrapped message.

Source

Thrown at upup/pkg/fi/cloudup/gcetasks/forwardingrule.go:230

			project = *e.Network.Project
		}
		o.Network = e.Network.URL(project)
	}

	if e.Subnetwork != nil {
		project := t.Cloud.Project()
		if e.Network.Project != nil {
			project = *e.Network.Project
		}
		o.Subnetwork = e.Subnetwork.URL(project, t.Cloud.Region())
	}

	if a == nil {
		klog.V(4).Infof("Creating ForwardingRule %q", o.Name)

		op, err := t.Cloud.Compute().ForwardingRules().Insert(ctx, t.Cloud.Project(), t.Cloud.Region(), o)
		if err != nil {
			return fmt.Errorf("error creating ForwardingRule %q: %v", o.Name, err)
		}

		if err := t.Cloud.WaitForOp(op); err != nil {
			return fmt.Errorf("error creating forwarding rule: %v", err)
		}

		if e.Labels != nil {
			// We can't set labels on creation; we have to read the object to get the fingerprint
			// TODO: We could get it from the operation!
			r, err := t.Cloud.Compute().ForwardingRules().Get(ctx, t.Cloud.Project(), t.Cloud.Region(), name)
			if err != nil {
				return fmt.Errorf("reading created ForwardingRule %q: %v", name, err)
			}

			req := compute.RegionSetLabelsRequest{
				LabelFingerprint: r.LabelFingerprint,
				Labels:           e.Labels,
			}

View on GitHub (pinned to 4c8573c808)

Solutions

1. Read the wrapped %v cause at the end of the message and address the specific GCE API error (quota, notFound, invalid field)
2. Verify referenced TargetPool/BackendService/Network/Subnetwork tasks exist and are in the same project/region
3. Check forwarding-rule quota with `gcloud compute regions describe <region>`
4. Re-run kops update; transient API errors are safe to retry since the task is idempotent

Example fix

null

// pre-flight: verify quota and referenced targets exist
op, err := fc.Compute().ForwardingRules().List(ctx, project, region)
// ensure name is unique; check `gcloud compute project-info describe` for quotas before insert

op, err := cloud.Compute().ForwardingRules().Insert(ctx, project, region, rule)
if err != nil {
    var gerr *googleapi.Error
    if errors.As(err, &gerr) {
        klog.Warningf("GCE insert failed: code=%d message=%s", gerr.Code, gerr.Message)
        if gerr.Code == 409 || gerr.Code == 429 { // conflict/quota: safe to retry later
            return retryAfterBackoff()
        }
    }
    return fmt.Errorf("error creating ForwardingRule %q: %v", name, err)
}

When it happens

Trigger: RenderGCE creates a rule: ForwardingRules().Insert(ctx, project, region, o) fails — e.g. invalid name/IPProtocol/PortRange/Target/BackendService/Network references, duplicate rule name, quota exceeded, or API auth failure.

Common situations: Invalid target pool or backend service URL; referenced subnetwork/network not found in project/region; forwarding-rule quota exhausted in the region; an egg/chicken race where the target was deleted mid-update; expired GCP credentials.

Related errors

• error creating forwarding rule: %v
• setting ForwardingRule labels: %w
• error fetching GCE instance: %w
• error fetching GCE instance group template %q: %v
• error fetching GCE managed instance group %q: %v

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/b755d2ba4c67db89. Report an issue: GitHub.