kubernetes/kops · error

error getting HealthCheck %q: %v

Error message

error getting HealthCheck %q: %v

What it means

HTTPHealthcheck.Find looks up the global HTTP health check via HTTPHealthChecks().Get(project, name). NotFound returns nil (resource absent); every other error is wrapped as this message and fails the reconcile.

Source

Thrown at upup/pkg/fi/cloudup/gcetasks/httphealthcheck.go:55

	Port        *int64
	RequestPath *string
}

var _ fi.CompareWithID = (*HTTPHealthcheck)(nil)

func (e *HTTPHealthcheck) CompareWithID() *string {
	return e.Name
}

func (e *HTTPHealthcheck) Find(c *fi.CloudupContext) (*HTTPHealthcheck, error) {
	cloud := c.T.Cloud.(gce.GCECloud)
	name := fi.ValueOf(e.Name)
	r, err := cloud.Compute().HTTPHealthChecks().Get(cloud.Project(), name)
	if err != nil {
		if gce.IsNotFound(err) {
			return nil, nil
		}
		return nil, fmt.Errorf("error getting HealthCheck %q: %v", name, err)
	}
	actual := &HTTPHealthcheck{
		Name:        new(r.Name),
		Port:        new(r.Port),
		RequestPath: new(r.RequestPath),
		SelfLink:    r.SelfLink,
	}
	// System fields
	actual.Lifecycle = e.Lifecycle
	e.SelfLink = r.SelfLink
	return actual, nil
}

func (e *HTTPHealthcheck) Run(c *fi.CloudupContext) error {
	return fi.CloudupDefaultDeltaRunMethod(e, c)
}

func (_ *HTTPHealthcheck) CheckChanges(a, e, changes *HTTPHealthcheck) error {

View on GitHub (pinned to 4c8573c808)

Solutions

1. Check the wrapped error code: 403 => add compute.healthChecks.get / compute.viewer IAM binding
2. Retry after backoff for 429/5xx responses
3. Refresh GCP credentials if authentication errors are wrapped
4. Confirm the health check name matches what exists (Find uses fi.ValueOf(e.Name))

Example fix

null

var gerr *googleapi.Error
if errors.As(err, &gerr) {
	switch {
	case gerr.Code == 404: // treat as absent
	case gerr.Code == 429 || gerr.Code >= 500: // retry with backoff
	case gerr.Code == 403: // fix IAM: compute.healthChecks.get
	}
}

When it happens

Trigger: cloud.Compute().HTTPHealthChecks().Get fails with a non-NotFound error: IAM denial on compute.healthChecks.get, expired credentials, rate limiting, network failure, or API error.

Common situations: Service account lacks compute.healthChecks.get; global vs regional mismatch (HTTPHealthChecks are global; looking in the wrong service surface); transient GCE API outage; token expiry during long applies.

Related errors

• error listing Health Checks: %v
• error creating Healthcheck %q: %v
• error updating Healthcheck %q: %v
• error finding CloudInstanceGroups: %v
• error deleting Subnetwork %s: %v

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/50fa32357315f3b8. Report an issue: GitHub.