kubernetes/kops · error

error listing Health Checks: %v

Error message

error listing Health Checks: %v

What it means

HealthCheck.Find reconciles desired vs actual state by calling RegionHealthChecks().Get. NotFound is treated as 'doesn't exist' (returns nil,nil), but any other API error is wrapped as this error and aborts reconciliation.

Source

Thrown at upup/pkg/fi/cloudup/gcetasks/healthcheck.go:87

	}
	return actual, err
}

func (e *HealthCheck) URL(cloud gce.GCECloud) string {
	return fmt.Sprintf("https://www.googleapis.com/compute/v1/projects/%s/regions/%s/healthChecks/%s",
		cloud.Project(),
		cloud.Region(),
		*e.Name)
}

func (e *HealthCheck) find(cloud gce.GCECloud) (*HealthCheck, error) {
	r, err := cloud.Compute().RegionHealthChecks().Get(cloud.Project(), cloud.Region(), *e.Name)
	if err != nil {
		if gce.IsNotFound(err) {
			return nil, nil
		}

		return nil, fmt.Errorf("error listing Health Checks: %v", err)
	}

	actual := &HealthCheck{}
	actual.Name = &r.Name
	switch r.Type {
	case "SSL":
		actual.Protocol = HealthCheckProtocolSSL
		if r.SslHealthCheck != nil {
			actual.Port = r.SslHealthCheck.Port
		}
	default:
		actual.Protocol = HealthCheckProtocolTCP
		if r.TcpHealthCheck != nil {
			actual.Port = r.TcpHealthCheck.Port
		}
	}

	return actual, nil

View on GitHub (pinned to 4c8573c808)

Solutions

1. Inspect the wrapped error code: 403 => grant compute.healthChecks.get / compute.viewer IAM role
2. Retry the apply after backoff for transient 429/5xx errors
3. Verify the health check's region matches the cluster region (cloud.Region())
4. Refresh credentials (gcloud auth application-default login / fix GOOGLE_CREDENTIALS) if auth errors appear

Example fix

null

// ensure credential/permission sanity before reconcile
gcloud projects get-iam-policy PROJECT --format=json | grep compute.healthChecks

if _, err := hc.Find(context); err != nil {
	var gerr *googleapi.Error
	if errors.As(err, &gerr) && (gerr.Code == 429 || gerr.Code >= 500) {
		// back off and retry the reconcile
	}
}

When it happens

Trigger: cloud.Compute().RegionHealthChecks().Get(project, region, name) returns a non-NotFound error: auth failure, permission denied on compute.healthChecks.get, quota/rate limit, network failure, or malformed name.

Common situations: Service account missing compute.healthChecks.get; regional health check exists in a different region than the cluster's; GCE API outage; token expired in long-running operations.

Related errors

• error creating healthcheck: %v
• error getting HealthCheck %q: %v
• error finding CloudInstanceGroups: %v
• error deleting HTTP HealthCheck %s: %v
• error deleting Subnetwork %s: %v

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/1b27c81afac378a0. Report an issue: GitHub.