kubernetes/kops · error

error fetching network %q: %w

Error message

error fetching network %q: %w

What it means

buildUsed fetches the GCE network via Networks().Get to compute used CIDR space during subnet/IP-alias assignments. If the API returns an error that is not a NotFound (which is tolerated as network=nil), it is wrapped in this error. It indicates a transient or permission-related failure to read the network, not a missing network.

Source

Thrown at upup/pkg/fi/cloudup/gce/network.go:99

	if networkName == "" {
		networkName = SafeClusterName(c.Name)
	}

	cloud := cloudObj.(GCECloud)
	networkName, projectName, err := ParseNameAndProjectFromNetworkID(networkName)
	if err != nil {
		return nil, err
	}
	if projectName == "" {
		projectName = cloud.Project()
	}

	network, err := cloud.Compute().Networks().Get(projectName, networkName)
	if err != nil {
		if IsNotFound(err) {
			network = nil
		} else {
			return nil, fmt.Errorf("error fetching network %q: %w", networkName, err)
		}
	}
	used := &subnet.CIDRMap{}

	if network == nil {
		return used, nil
	}

	subnetURLs := make(map[string]bool)
	for _, subnet := range network.Subnetworks {
		subnetURLs[subnet] = true
	}
	if len(subnetURLs) == 0 {
		return used, nil
	}

	klog.Infof("scanning regions for subnetwork CIDR allocations")

View on GitHub (pinned to 4c8573c808)

Solutions

1. Retry the kops command — most underlying errors are transient API failures
2. Verify the service account has compute.networks.get (roles/compute.networkViewer or Compute Viewer) on the project owning the network
3. If using a cross-project networkID, confirm the project ID is correct and Shared VPC access is configured
4. Check GCP status / quota for the Compute API in the project

// pre-check IAM before running kops
// gcloud projects get-iam-policy PROJECT --flatten="bindings[].members" --filter="bindings.role=roles/compute.networkViewer"

_, err := buildUsed(ctx, cluster, cloud)
if err != nil && strings.Contains(err.Error(), "error fetching network") {
	// distinguish transient vs permission: inspect wrapped googleapi.Error
	var gerr *googleapi.Error
	if errors.As(err, &gerr) && (gerr.Code == 429 || gerr.Code >= 500) {
		// safe to retry with backoff
	}
	return err
}

When it happens

Trigger: Cloud Compute API outage or rate limiting (429/5xx) during Networks().Get; the credentials/service account lacking compute.networks.get permission on the (possibly cross-project) network; networkID pointing at a project the caller cannot access.

Common situations: Cross-project network shared via Shared VPC where the kops service account lacks access; GCP API quota exhaustion during a large update; transient API errors during cluster create/update.

Related errors

• error listing Subnetworks in region %q: %w
• failed to parse subnet CIDR %q: %w
• error listing networks: %v
• error deleting network %s: %v
• cannot parse network name %q as either project/network or ne

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/f38b620739d2889b. Report an issue: GitHub.