kubernetes/kops · error

error deleting router %s: %v

Error message

error deleting router %s: %v

What it means

Thrown by deleteRouter when Compute Routers().Delete fails with any error except NotFound. The cluster's Cloud Router (used by NAT etc.) could not be removed; the wrapped self-link and API error identify which router and why.

Source

Thrown at pkg/resources/gce/gce.go:1006

}

func deleteRouter(cloud fi.Cloud, r *resources.Resource) error {
	c := cloud.(gce.GCECloud)
	o := r.Obj.(*compute.Router)

	klog.V(2).Infof("deleting GCE router %s", o.SelfLink)
	u, err := gce.ParseGoogleCloudURL(o.SelfLink)
	if err != nil {
		return err
	}

	op, err := c.Compute().Routers().Delete(u.Project, u.Region, u.Name)
	if err != nil {
		if gce.IsNotFound(err) {
			klog.Infof("Router not found, assuming deleted: %q", o.SelfLink)
			return nil
		}
		return fmt.Errorf("error deleting router %s: %v", o.SelfLink, err)
	}

	return c.WaitForOp(op)
}

func (d *clusterDiscoveryGCE) listServiceAccounts() ([]*resources.Resource, error) {
	c := d.gceCloud
	ctx := context.Background()

	sas, err := c.IAM().ServiceAccounts().List(ctx, fmt.Sprintf("projects/%s", c.Project()))
	if err != nil {
		return nil, fmt.Errorf("error listing ServiceAccounts %w", err)
	}
	var resourceTrackers []*resources.Resource
	for _, sa := range sas {
		tokens := strings.Split(gce.LastComponent(sa.Name), "@")
		if len(tokens) != 2 {
			return nil, fmt.Errorf("Invalid service account email '%s'", gce.LastComponent(sa.Name))

View on GitHub (pinned to 4c8573c808)

Solutions

1. Check the wrapped error code; handle 'still in use' by deleting dependent Cloud NAT configs first.
2. Ensure the identity has compute.routers.delete (compute.networkAdmin role).
3. Retry on 409/429/5xx with backoff; deletion is idempotent since NotFound returns success.
4. Verify manually with `gcloud compute routers list` and delete leftovers with `gcloud compute routers delete`.

Example fix

// before
return fmt.Errorf("error deleting router %s: %v", o.SelfLink, err)
// after
if apiErr, ok := err.(*googleapi.Error); ok && apiErr.Code == 400 && strings.Contains(apiErr.Message, "being used") {
	return fmt.Errorf("router %s still in use (delete Cloud NAT configs first): %w", o.SelfLink, err)
}
return fmt.Errorf("error deleting router %s: %w", o.SelfLink, err)

// before delete, verify no Cloud NAT depends on the router
nats, err := computeClient.Nats().List(ctx, project, region)
if err == nil {
	for _, n := range nats {
		if n.Router == routerName { return fmt.Errorf("router %s used by NAT %s", routerName, n.Name) }
	}
}

func isStillInUse(err error) bool {
	ge, ok := err.(*googleapi.Error)
	return ok && ge.Code == 400 && strings.Contains(ge.Message, "being used")
}

if err := deleteRouter(project, region, name); err != nil {
	var ge *googleapi.Error
	if errors.As(err, &ge) && (ge.Code == 409 || ge.Code == 429 || ge.Code >= 500) {
		// backoff and retry
	} else if gce.IsNotFound(err) {
		return nil // already gone
	}
	return err
}

When it happens

Trigger: Routers().Delete(project, region, name) returns 403 (no delete permission), 400 failedPrecondition (router attached to resources like Cloud NAT or interconnects still in use), 409 conflict, or transient 5xx.

Common situations: Cloud NAT configs still referencing the router during cluster teardown; restricted IAM for the deletion identity; router in a state locked by another operation; API throttling during mass deletion.

Related errors

• error deleting Subnetwork %s: %v
• error listing routers: %v
• deleting forwardingRule %s: %w
• error finding CloudInstanceGroups: %v
• error deleting ServiceAccount %s: %v

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/2165f206f17d2553. Report an issue: GitHub.