kubernetes/kops · error

error getting ForwardingRule %q: %v

Error message

error getting ForwardingRule %q: %v

What it means

ForwardingRule.Find() looks up the forwarding rule via Compute().ForwardingRules().Get(). NotFound is treated as 'resource absent' (returns nil,nil), but any other API failure is wrapped as 'error getting ForwardingRule %q: %v'. It means the discovery/read step for reconciliation failed.

Source

Thrown at upup/pkg/fi/cloudup/gcetasks/forwardingrule.go:89

	return e.Name
}

func (e *ForwardingRule) PruneForwardingRulesWithName(name string) {
	e.pruneForwardingRules = append(e.pruneForwardingRules, forwardingRulePruneSpec{Name: name})
}

func (e *ForwardingRule) Find(c *fi.CloudupContext) (*ForwardingRule, error) {
	ctx := c.Context()

	cloud := c.T.Cloud.(gce.GCECloud)
	name := fi.ValueOf(e.Name)

	r, err := cloud.Compute().ForwardingRules().Get(ctx, cloud.Project(), cloud.Region(), name)
	if err != nil {
		if gce.IsNotFound(err) {
			return nil, nil
		}
		return nil, fmt.Errorf("error getting ForwardingRule %q: %v", name, err)
	}

	actual := &ForwardingRule{
		Name:       new(r.Name),
		IPProtocol: r.IPProtocol,
	}
	if r.PortRange != "" {
		actual.PortRange = &r.PortRange
	}
	if len(r.Ports) > 0 {
		actual.Ports = r.Ports
	}

	if r.Target != "" {
		actual.TargetPool = &TargetPool{
			Name: new(lastComponent(r.Target)),
		}
	}

View on GitHub (pinned to 4c8573c808)

Solutions

1. Check the wrapped %v detail for the specific Google API status code.
2. Verify the service account has compute.viewer / compute.forwardingRules.get rights.
3. Confirm the cluster's region setting matches where the load balancer lives.
4. Retry after a short delay if the error is rateLimitExceeded or transient.

// pre-checks before apply:
// gcloud compute forwarding-rules describe NAME --region=R --project=P
// gcloud projects get-iam-policy PROJECT  # confirm compute.forwardingRules.get

var lastErr error
for attempt := 0; attempt < 3; attempt++ {
  err := kopsUpdate()
  if err == nil { break }
  lastErr = err
  var gerr *googleapi.Error
  if errors.As(err, &gerr) && (gerr.Code == 429 || gerr.Code >= 500) {
    time.Sleep(time.Duration(1<<attempt) * time.Second)
    continue
  }
  log.Fatalf("forwarding rule get failed: %v", err)
}

When it happens

Trigger: ForwardingRules().Get returns a non-404 error: permission denied on the compute API, invalid region/project, rate limiting, or backend API outage during kops update/cluster diff.

Common situations: Service account missing compute.forwardingRules.get; misconfigured region in kops cluster spec; GCP API quota/rate limits during large applies; intermittent 500s from the Compute API.

Related errors

• error getting ForwardingRule %q: %w
• error creating FirewallRule: %v
• error finding Address with IP=%q: %w
• error finding Address %q: %v
• did not find API endpoint

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/5ac187af53d466ae. Report an issue: GitHub.