kubernetes/kops · error

error listing Subnetworks in region %q: %w

Error message

error listing Subnetworks in region %q: %w

What it means

After deriving the set of regions from subnet URLs, buildUsed lists all subnetworks in each region to compute allocated CIDRs. Any non-nil error from Subnetworks().List is wrapped as this error with the region name. NotFound is not specially handled here, so a bad region or missing compute permissions also lands here.

Source

Thrown at upup/pkg/fi/cloudup/gce/network.go:131

		return used, nil
	}

	klog.Infof("scanning regions for subnetwork CIDR allocations")

	regions := make(map[string]bool)
	for subnetURL := range subnetURLs {
		u, err := ParseGoogleCloudURL(subnetURL)
		if err != nil {
			return nil, fmt.Errorf("error parsing subnet url %q: %w", subnetURL, err)
		}
		regions[u.Region] = true
	}

	var subnets []*compute.Subnetwork
	for region := range regions {
		l, err := cloud.Compute().Subnetworks().List(ctx, cloud.Project(), region)
		if err != nil {
			return nil, fmt.Errorf("error listing Subnetworks in region %q: %w", region, err)
		}
		subnets = append(subnets, l...)
	}

	for _, subnet := range subnets {
		if !subnetURLs[subnet.SelfLink] {
			continue
		}
		if err := used.MarkInUse(subnet.IpCidrRange); err != nil {
			return nil, err
		}

		for _, s := range subnet.SecondaryIpRanges {
			if err := used.MarkInUse(s.IpCidrRange); err != nil {
				return nil, err
			}
		}
	}

View on GitHub (pinned to 4c8573c808)

Solutions

1. Retry the kops command to rule out transient API failures
2. Grant compute.subnetworks.list (Compute Network Viewer) on the relevant project (host project for Shared VPC)
3. Verify the region in each subnet self-link exists and matches the cluster's region
4. Check GCP quotas and API status for the project

// verify list permission beforehand
// gcloud compute networks list --project=PROJECT  (and subnets list per region)

used, err := buildUsed(ctx, cluster, cloud)
if err != nil && strings.Contains(err.Error(), "error listing Subnetworks") {
	var gerr *googleapi.Error
	if errors.As(err, &gerr) && (gerr.Code == 429 || gerr.Code >= 500) {
		// transient: retry with backoff
	}
	return err
}

When it happens

Trigger: Compute API error while listing subnetworks in a region (quota, 5xx, throttling); a region name parsed from a subnet URL that does not exist in the project; service account lacking compute.subnetworks.list permission.

Common situations: Shared VPC where the service project's service account cannot list subnets in the host project's region; typo in region in a custom subnet self-link; transient GCP outage during kops update.

Related errors

• error fetching network %q: %w
• failed to parse subnet CIDR %q: %w
• error listing subnetworks: %v
• error parsing subnet url %q: %w
• error waiting for Subnet patch to complete: %w

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/6385db165fda5887. Report an issue: GitHub.