kubernetes/kops · error

error getting IAM policy for project %s: %w

Error message

error getting IAM policy for project %s: %w

What it means

Wrapped error from ProjectIAMBinding.RenderGCE when the GetIamPolicy call fails during the apply phase (under a per-project mutex to avoid concurrent modifications). The request itself is a plain GetIamPolicy; failure means permissions, project, or API issues.

Source

Thrown at upup/pkg/fi/cloudup/gcetasks/projectiambinding.go:119

	return nil
}

func (_ *ProjectIAMBinding) RenderGCE(t *gce.GCEAPITarget, a, e, changes *ProjectIAMBinding) error {
	ctx := context.TODO()

	projectID := fi.ValueOf(e.Project)
	member := "serviceAccount:" + fi.ValueOf(e.MemberServiceAccount.Email)
	role := fi.ValueOf(e.Role)

	// Avoid concurrent operations
	localMutex := gce.MutexForProjectIAM(projectID)
	localMutex.Lock()
	defer localMutex.Unlock()

	request := &cloudresourcemanager.GetIamPolicyRequest{}
	policy, err := t.Cloud.CloudResourceManager().Projects.GetIamPolicy(projectID, request).Context(ctx).Do()
	if err != nil {
		return fmt.Errorf("error getting IAM policy for project %s: %w", projectID, err)
	}

	changed := patchCRMPolicy(policy, member, role)

	if !changed {
		klog.Warningf("did not need to change policy (concurrent change?)")
		return nil
	}

	klog.V(2).Infof("updating IAM for project %s", projectID)
	if _, err := t.Cloud.CloudResourceManager().Projects.SetIamPolicy(projectID, &cloudresourcemanager.SetIamPolicyRequest{Policy: policy}).Context(ctx).Do(); err != nil {
		return fmt.Errorf("error updating IAM for project %s: %w", projectID, err)
	}

	return nil
}

// terraformProjectIAMBinding is the model for a terraform google_project_iam_binding rule

View on GitHub (pinned to 4c8573c808)

Solutions

1. Inspect the wrapped error for the exact CRM failure
2. Ensure the kOps service account can read the project's IAM policy
3. Retry after resolving permissions or transient errors

When it happens

Trigger: Thrown at upup/pkg/fi/cloudup/gcetasks/projectiambinding.go:119 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/bb8fdb69caf9944f. Report an issue: GitHub.