kubernetes/kops · error

error creating healthcheck

Error message

error creating healthcheck: %v

What it means

In RenderGCE, when the health check does not exist (actual == nil), the task inserts it via RegionHealthChecks().Insert. If the Insert call itself returns an error (before waiting on the operation), it is wrapped with this message.

Solutions

1. Fix the underlying error: check name conflicts and quota in the GCE console for that region
2. Grant compute.healthChecks.create (roles/compute.networkAdmin) to the service account
3. Validate the cluster spec's health check fields (port range, protocol) before applying
4. Retry after backoff if the wrapped code is 429/5xx

Example fix

null

// validate spec before apply
if hc.Port < 1 || hc.Port > 65535 { return errors.New("invalid health check port") }
if existing != nil { return errors.New("health check already exists; update not supported") }

var gerr *googleapi.Error
if errors.As(err, &gerr) && gerr.Code == 409 {
	// name conflict: fetch the existing check and reconcile instead of inserting
}

When it happens

Trigger: RegionHealthChecks().Insert(project, region, hc) fails immediately: invalid HealthCheck spec (bad port/protocol fields), duplicate name in region, permission denied on compute.healthChecks.create, quota exceeded, or API error.

Common situations: IAM missing compute.healthChecks.create; a stale health check with the same name exists but Find failed to see it; malformed request path/port from cluster spec; exceeding regional health-check quota.

Related errors

• error creating Healthcheck
• error listing Health Checks
• cannot apply changes to healthcheck
• deleting forwardingRule
• error deleting HTTP HealthCheck

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/c3dbc4be37cb366c. Report an issue: GitHub.

Appendix: source

Thrown at upup/pkg/fi/cloudup/gcetasks/healthcheck.go:152

	switch e.protocol() {
	case HealthCheckProtocolSSL:
		hc.Type = "SSL"
		hc.SslHealthCheck = &compute.SSLHealthCheck{
			Port: e.Port,
		}
	default:
		hc.Type = "TCP"
		hc.TcpHealthCheck = &compute.TCPHealthCheck{
			Port: e.Port,
		}
	}

	if a == nil {
		klog.V(2).Infof("Creating HealthCheck %q", hc.Name)

		op, err := cloud.Compute().RegionHealthChecks().Insert(cloud.Project(), cloud.Region(), hc)
		if err != nil {
			return fmt.Errorf("error creating healthcheck: %v", err)
		}

		if err := cloud.WaitForOp(op); err != nil {
			return fmt.Errorf("error waiting for healthcheck: %v", err)
		}
	} else {
		return fmt.Errorf("cannot apply changes to healthcheck: %v", changes)
	}

	return nil
}

type terraformHealthCheckBlock struct {
	Port int64 `cty:"port"`
}

type terraformHealthCheck struct {
	Name           string                     `cty:"name"`

View on GitHub (pinned to 4c8573c808)