kubernetes/kops · error

error creating Healthcheck

Error message

error creating Healthcheck %q: %v

What it means

When creating a new HTTPHealthcheck, RenderGCE calls HTTPHealthChecks().Insert. If the synchronous Insert call errors (before waiting on the returned operation), the error is wrapped with the health check name for context.

Solutions

1. Resolve the wrapped googleapi error: fix spec fields (port 1-65535, requestPath starting with /) on validation errors
2. Grant compute.healthChecks.create IAM permission to the service account
3. Check/raise the global health check quota, or remove a conflicting same-name check
4. Retry after backoff for transient 429/5xx

Example fix

null

// validate before insert
if o.Port < 1 || o.Port > 65535 { return errors.New("invalid port") }
if !strings.HasPrefix(o.RequestPath, "/") { return errors.New("requestPath must start with /") }

var gerr *googleapi.Error
if errors.As(err, &gerr) && gerr.Code == 409 {
	// name conflict: the check already exists; fall through to update path
}

When it happens

Trigger: HTTPHealthChecks().Insert(project, o) fails immediately: invalid HttpHealthCheck spec (bad port/requestPath/host fields), name conflict, quota exceeded, or IAM denial on compute.healthChecks.create.

Common situations: Missing compute.healthChecks.create permission; duplicate global health check name; malformed request path from the instance-group/cluster spec; global health-check quota exhausted.

Related errors

• error creating healthcheck
• error getting HealthCheck
• error updating Healthcheck
• deleting forwardingRule
• error creating Healthcheck

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/8ed2b1778483c02c. Report an issue: GitHub.

Appendix: source

Thrown at upup/pkg/fi/cloudup/gcetasks/httphealthcheck.go:94

	}
	if a != nil && changes.Name != nil {
		return fi.CannotChangeField("Name")
	}
	return nil
}

func (h *HTTPHealthcheck) RenderGCE(t *gce.GCEAPITarget, a, e, changes *HTTPHealthcheck) error {
	if a == nil {
		o := &compute.HttpHealthCheck{
			Name:        fi.ValueOf(e.Name),
			Port:        fi.ValueOf(e.Port),
			RequestPath: fi.ValueOf(e.RequestPath),
		}

		klog.V(4).Infof("Creating Healthcheck %q", o.Name)
		r, err := t.Cloud.Compute().HTTPHealthChecks().Insert(t.Cloud.Project(), o)
		if err != nil {
			return fmt.Errorf("error creating Healthcheck %q: %v", o.Name, err)
		}
		if err := t.Cloud.WaitForOp(r); err != nil {
			return fmt.Errorf("error creating Healthcheck: %v", err)
		}
		h.SelfLink = r.TargetLink
	} else if changes.Port != nil || changes.RequestPath != nil {
		// Insert only applies these on create, so reconcile changes to an existing check with a separate Update.
		o := &compute.HttpHealthCheck{
			Name:        fi.ValueOf(e.Name),
			Port:        fi.ValueOf(e.Port),
			RequestPath: fi.ValueOf(e.RequestPath),
		}

		klog.V(4).Infof("Updating Healthcheck %q", o.Name)
		r, err := t.Cloud.Compute().HTTPHealthChecks().Update(t.Cloud.Project(), o.Name, o)
		if err != nil {
			return fmt.Errorf("error updating Healthcheck %q: %v", o.Name, err)
		}

View on GitHub (pinned to 4c8573c808)