kubernetes/kops · error

error listing networks

Error message

error listing networks: %v

What it means

Fires in listNetworks when the GCE Networks().List call fails while discovering the cluster's VPC network during resource discovery/teardown — a GCE API, credentials, or network failure listing networks.

Solutions

1. Check GCP credentials and compute.networks.list permission
2. Retry after transient API errors
3. Verify the project is correct and accessible

Example fix

// before
return nil, fmt.Errorf("error listing networks: %v", err)
// after
return nil, fmt.Errorf("error listing networks in project %s: %w", c.Project(), err)

// preflight with same credentials before mutating anything
_, err := computeClient.Networks.List(project).Do()
if err != nil {
	return fmt.Errorf("preflight: cannot list networks in %s; check API/permissions: %w", project, err)
}

func isPermissionDenied(err error) bool {
	ge, ok := err.(*googleapi.Error)
	return ok && ge.Code == 403
}

networks, err := c.Compute().Networks().List(c.Project())
if err != nil {
	if isPermissionDenied(err) {
		return nil, fmt.Errorf("needs compute.networks.list in %s: %w", c.Project(), err)
	}
	return nil, fmt.Errorf("error listing networks: %w", err)
}

When it happens

Trigger: Networks().List returns 403 (missing compute.networks.list), Compute API disabled or quota/billing issue, invalid project, or transient API failure. Note the code indexes networks.Items without a nil check, so an empty-but-successful response shape change could also matter — but this specific error only fires on the API error path.

Common situations: kops credentials with compute rights missing in the target project; wrong project ID in config; Compute Engine API not enabled; GCE API outage during delete cluster.

Related errors

• error deleting network
• cannot parse network name
• error associating AdditionalCIDR to VPC
• error fetching network
• error listing Addresses

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/9707fd7ddd9ce383. Report an issue: GitHub.

Appendix: source

Thrown at pkg/resources/gce/gce.go:1214

	if err != nil {
		return nil, err
	}
	networkUrls := make(map[string]bool)
	for _, t := range templates {
		for _, ni := range t.Properties.NetworkInterfaces {
			if ni.Network != "" {
				networkUrls[ni.Network] = true
			}
		}
	}

	c := d.gceCloud

	var resourceTrackers []*resources.Resource

	networks, err := c.Compute().Networks().List(c.Project())
	if err != nil {
		return nil, fmt.Errorf("error listing networks: %v", err)
	}

	for _, o := range networks.Items {
		if o.Name != gce.SafeTruncatedClusterName(d.clusterName, 63) {
			klog.V(8).Infof("skipping network with name %q", o.Name)
			continue
		}

		if !networkUrls[o.SelfLink] {
			klog.Warningf("skipping network %q because it didn't match any instance template", o.SelfLink)
			continue
		}

		resourceTracker := &resources.Resource{
			Name:    o.Name,
			ID:      o.Name,
			Type:    typeNetwork,
			Deleter: deleteNetwork,

View on GitHub (pinned to 4c8573c808)