kubernetes/kops · error

error listing FirewallRules: %v

Error message

error listing FirewallRules: %v

What it means

listFirewallRules wraps the Compute Firewalls.List failure while discovering cluster firewall rules by name prefix/labels. It fires on GCE API errors (auth, disabled API); this path is also exercised by TestListFirewallRulesLoadBalancer.

Source

Thrown at pkg/resources/gce/gce.go:528

			return nil
		}
		return fmt.Errorf("error deleting ForwardingRule %s: %v", t.SelfLink, err)
	}

	return c.WaitForOp(op)
}

// listFirewallRules discovers Firewall objects for the cluster
func (d *clusterDiscoveryGCE) listFirewallRules() ([]*resources.Resource, error) {
	c := d.gceCloud

	var resourceTrackers []*resources.Resource

	ctx := context.Background()

	firewallRules, err := c.Compute().Firewalls().List(ctx, c.Project())
	if err != nil {
		return nil, fmt.Errorf("error listing FirewallRules: %v", err)
	}

nextFirewallRule:
	for _, firewallRule := range firewallRules {
		if !d.matchesClusterNameMultipart(firewallRule.Name, maxPrefixTokens) && !strings.HasPrefix(firewallRule.Name, "k8s-") {
			continue
		}

		// TODO: Check network?  (or other fields?)  No label support currently.

		// We consider only firewall rules that target our cluster tags, which include the cluster name or hash
		tagPrefix := gce.SafeClusterName(d.clusterName) + "-"
		clusterNameHash := truncate.HashString(gce.SafeClusterName(d.clusterName), 6)
		if len(firewallRule.TargetTags) != 0 {
			tagMatchCount := 0
			for _, target := range firewallRule.TargetTags {
				if strings.HasPrefix(target, tagPrefix) || strings.Contains(target, clusterNameHash) {
					tagMatchCount++

View on GitHub (pinned to 4c8573c808)

Solutions

1. Check GCP credentials and compute.firewalls.list permission
2. Retry after transient API errors
3. Verify the project is correct and accessible

When it happens

Trigger: Thrown at pkg/resources/gce/gce.go:528 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/f62f19a2fb37091f. Report an issue: GitHub.