kubernetes/kops · error

error listing routers: %v

Error message

error listing routers: %v

What it means

Thrown by listRouters in pkg/resources/gce/gce.go when the Compute Routers().List call for the project/region fails. This is a read-only enumeration step used to find cluster-owned Cloud Routers during cluster discovery/teardown; the error aborts building the resource tracker list.

Source

Thrown at pkg/resources/gce/gce.go:966

		if gce.IsNotFound(err) {
			klog.Infof("Subnetwork not found, assuming deleted: %q", o.SelfLink)
			return nil
		}
		return fmt.Errorf("error deleting Subnetwork %s: %v", o.SelfLink, err)
	}

	return c.WaitForOp(op)
}

func (d *clusterDiscoveryGCE) listRouters() ([]*resources.Resource, error) {
	c := d.gceCloud

	var resourceTrackers []*resources.Resource
	ctx := context.Background()

	routers, err := c.Compute().Routers().List(ctx, c.Project(), c.Region())
	if err != nil {
		return nil, fmt.Errorf("error listing routers: %v", err)
	}

	for _, o := range routers {
		if !d.matchesClusterName(o.Name) {
			klog.V(8).Infof("skipping Router with name %q", o.Name)
			continue
		}

		resourceTracker := &resources.Resource{
			Name:    o.Name,
			ID:      o.Name,
			Type:    typeRouter,
			Deleter: deleteRouter,
			Obj:     o,
		}

		klog.V(4).Infof("found resource: %s", o.SelfLink)
		resourceTrackers = append(resourceTrackers, resourceTracker)

View on GitHub (pinned to 4c8573c808)

Solutions

1. Read the wrapped error for the API status code and message.
2. Verify Compute Engine API is enabled: gcloud services enable compute.googleapis.com.
3. Grant the credentials compute.networkViewer / compute.routers.list permission in the target project.
4. Confirm the region in the cluster spec matches an existing GCE region (e.g. us-central1, not us-central1-a).
5. Retry if the error is 429/5xx.

Example fix

// before
return nil, fmt.Errorf("error listing routers: %v", err)
// after (skip non-cluster regions gracefully, preserve cause)
return nil, fmt.Errorf("error listing routers in %s/%s: %w", c.Project(), c.Region(), err)

// preflight: credentials and region validity
if _, err := netid.ParseRegion(region); err != nil { return err }
_, err := computeClient.Routers().List(ctx, project, region)
_ = err // verify list works before mutating anything

func isPermissionDenied(err error) bool {
	ge, ok := err.(*googleapi.Error)
	return ok && ge.Code == 403
}

routers, err := c.Compute().Routers().List(ctx, project, region)
if err != nil {
	if isPermissionDenied(err) {
		return fmt.Errorf("needs compute.routers.list on %s: %w", project, err)
	}
	return fmt.Errorf("error listing routers: %w", err)
}

When it happens

Trigger: Calling Routers().List(ctx, project, region) and receiving any API error: 403 permission denied (missing compute.routers.list), invalid/unknown region name, disabled Compute API, quota exhaustion, or network outage.

Common situations: Service account lacking compute viewer roles; kops configured with a region the credentials can't access; Compute Engine API disabled in the project; transient GCE API unavailability during delete cluster.

Related errors

• error deleting router %s: %v
• error finding CloudInstanceGroups: %v
• error listing Routes: %w
• error listing Addresses: %v
• error listing subnetworks: %v

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/f6a60c870dcfb898. Report an issue: GitHub.