kubernetes/kops · error

error getting TargetPool %q: %w

Error message

error getting TargetPool %q: %w

What it means

This error wraps a non-NotFound failure from the Compute TargetPools().Get API during listFirewallRules. After resolving the forwarding rule, kOps looks up its target pool to discover associated health checks; any API failure other than a handled case aborts discovery with this wrapped message. The target pool name is derived from forwardingRule.Target via gce.LastComponent.

Source

Thrown at pkg/resources/gce/gce.go:616

			}
			if forwardingRule.Target != "" {
				forwardingRuleResource.Blocks = append(forwardingRuleResource.Blocks, typeTargetPool+":"+gce.LastComponent(forwardingRule.Target))
			}
			k8sResources = append(k8sResources, forwardingRuleResource)

			// TODO: Can we get k8s to set labels on the ForwardingRule?

			// TODO: Check description?  It looks like e.g. description: '{"kubernetes.io/service-name":"kube-system/guestbook"}'

			if forwardingRule.Target == "" {
				klog.Warningf("forwarding rule %q did not have target, assuming firewallRule %q is not a k8s rule", forwardingRuleName, firewallRule.Name)
				continue nextFirewallRule
			}

			targetPoolName := gce.LastComponent(forwardingRule.Target)
			targetPool, err := c.Compute().TargetPools().Get(c.Project(), c.Region(), targetPoolName)
			if err != nil {
				return nil, fmt.Errorf("error getting TargetPool %q: %w", targetPoolName, err)
			}

			targetPoolResource := &resources.Resource{
				Name:    targetPool.Name,
				ID:      targetPool.Name,
				Type:    typeTargetPool,
				Deleter: deleteTargetPool,
				Obj:     targetPool,
			}
			k8sResources = append(k8sResources, targetPoolResource)

			// TODO: Check description? (looks like description: '{"kubernetes.io/service-name":"k8s-dbb09d49d9780e7e-node"}' )

			// TODO: Check instances?

			for _, healthCheckLink := range targetPool.HealthChecks {
				// l4 level healthchecks

View on GitHub (pinned to 4c8573c808)

Solutions

1. Retry the command; many failures are transient API/5xx issues.
2. Verify compute.targetPools.get IAM permission for the credentials in use.
3. Inspect the forwarding rule's target link in the GCP console; if it references another project/region, the firewall rule is not a kOps rule — delete it manually.
4. Check c.Region() matches the target pool's region (target pools are regional).
5. Use errors.As on the wrapped error to identify the exact Google API status.

// verify the forwarding rule's target resolves within the expected project/region
tl, err := computeService.ForwardingRules.Get(project, region, frName).Do()
if err == nil && tl.Target != "" {
    if !strings.Contains(tl.Target, "projects/"+project+"/") {
        return fmt.Errorf("forwarding rule %s targets another project: %s", frName, tl.Target)
    }
}

func isGCEAPIError(err error) (*googleapi.Error, bool) {
    var gerr *googleapi.Error
    return gerr, errors.As(err, &gerr)
}

pools, err := listFirewallRules(ctx, c)
if err != nil {
    var gerr *googleapi.Error
    if errors.As(err, &gerr) && gerr.Code == 404 {
        return nil // treat as nothing to clean up
    }
    return err
}

When it happens

Trigger: c.Compute().TargetPools().Get(project, region, targetPoolName) fails with permission denied, rate limiting, transient 5xx, or a malformed/foreign Target link on the forwarding rule that yields a name that cannot be fetched (e.g. pointing to another project or a legacy target).

Common situations: Forwarding rule was created outside kOps and points at a target pool in another project or region; IAM role stripped from the kops service account; GCE API transient outage mid-deletion; project ID mismatch after reconfiguring credentials.

Related errors

• error getting ForwardingRule %q: %w
• error listing Routes: %w
• error listing Addresses: %v
• error listing subnetworks: %v
• error listing InstanceGroupManagers: %v

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/b9d4072a7b75776a. Report an issue: GitHub.