kubernetes/kops · error

error creating healthcheck: %v

Error message

error creating healthcheck: %v

What it means

In RenderGCE, when the health check does not exist (actual == nil), the task inserts it via RegionHealthChecks().Insert. If the Insert call itself returns an error (before waiting on the operation), it is wrapped with this message.

Source

Thrown at upup/pkg/fi/cloudup/gcetasks/healthcheck.go:152

	switch e.protocol() {
	case HealthCheckProtocolSSL:
		hc.Type = "SSL"
		hc.SslHealthCheck = &compute.SSLHealthCheck{
			Port: e.Port,
		}
	default:
		hc.Type = "TCP"
		hc.TcpHealthCheck = &compute.TCPHealthCheck{
			Port: e.Port,
		}
	}

	if a == nil {
		klog.V(2).Infof("Creating HealthCheck %q", hc.Name)

		op, err := cloud.Compute().RegionHealthChecks().Insert(cloud.Project(), cloud.Region(), hc)
		if err != nil {
			return fmt.Errorf("error creating healthcheck: %v", err)
		}

		if err := cloud.WaitForOp(op); err != nil {
			return fmt.Errorf("error waiting for healthcheck: %v", err)
		}
	} else {
		return fmt.Errorf("cannot apply changes to healthcheck: %v", changes)
	}

	return nil
}

type terraformHealthCheckBlock struct {
	Port int64 `cty:"port"`
}

type terraformHealthCheck struct {
	Name           string                     `cty:"name"`

View on GitHub (pinned to 4c8573c808)

Solutions

1. Fix the underlying error: check name conflicts and quota in the GCE console for that region
2. Grant compute.healthChecks.create (roles/compute.networkAdmin) to the service account
3. Validate the cluster spec's health check fields (port range, protocol) before applying
4. Retry after backoff if the wrapped code is 429/5xx

Example fix

null

// validate spec before apply
if hc.Port < 1 || hc.Port > 65535 { return errors.New("invalid health check port") }
if existing != nil { return errors.New("health check already exists; update not supported") }

var gerr *googleapi.Error
if errors.As(err, &gerr) && gerr.Code == 409 {
	// name conflict: fetch the existing check and reconcile instead of inserting
}

When it happens

Trigger: RegionHealthChecks().Insert(project, region, hc) fails immediately: invalid HealthCheck spec (bad port/protocol fields), duplicate name in region, permission denied on compute.healthChecks.create, quota exceeded, or API error.

Common situations: IAM missing compute.healthChecks.create; a stale health check with the same name exists but Find failed to see it; malformed request path/port from cluster spec; exceeding regional health-check quota.

Related errors

• error listing Health Checks: %v
• error creating Healthcheck %q: %v
• error finding CloudInstanceGroups: %v
• error deleting HTTP HealthCheck %s: %v
• error deleting Subnetwork %s: %v

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/c3dbc4be37cb366c. Report an issue: GitHub.