kubernetes/kops · error

error listing subnetworks: %v

Error message

error listing subnetworks: %v

What it means

Wraps a failure from Compute Subnetworks().List in listSubnets, which lists regional subnetworks and filters by cluster name during discovery. Any List failure aborts the discovery pass. This call requires compute.subnetworks.list in the given project/region; like the addresses path it formats with %v so the raw error text is preserved in the message only.

Source

Thrown at pkg/resources/gce/gce.go:904

		return nil, err
	}
	subnetworkUrls := make(map[string]bool)
	for _, t := range templates {
		for _, ni := range t.Properties.NetworkInterfaces {
			if ni.Subnetwork != "" {
				subnetworkUrls[ni.Subnetwork] = true
			}
		}
	}

	c := d.gceCloud

	var resourceTrackers []*resources.Resource
	ctx := context.Background()

	subnets, err := c.Compute().Subnetworks().List(ctx, c.Project(), c.Region())
	if err != nil {
		return nil, fmt.Errorf("error listing subnetworks: %v", err)
	}

	for _, o := range subnets {
		if !d.matchesClusterName(o.Name) {
			klog.V(8).Infof("skipping Subnet with name %q", o.Name)
			continue
		}

		if !subnetworkUrls[o.SelfLink] {
			klog.Warningf("skipping subnetwork %q because it didn't match any instance template", o.SelfLink)
			continue
		}

		resourceTracker := &resources.Resource{
			Name:    o.Name,
			ID:      o.Name,
			Type:    typeSubnet,
			Deleter: deleteSubnet,

View on GitHub (pinned to 4c8573c808)

Solutions

1. Verify the region in the cluster spec is correct and non-empty.
2. Grant compute.subnetworks.list (roles/compute.networkViewer) on the project — and the host project for shared VPC.
3. Retry on 429/5xx with backoff.
4. Confirm the correct project ID is configured in credentials/environment.
5. Check klog output for the raw error string to get the exact Google API status code.

// validate region and subnet visibility before discovery
if region == "" {
    return fmt.Errorf("region is empty in cluster spec")
}
if _, err := computeService.Subnetworks.List(project, region).PageSize(1).Do(); err != nil {
    if gerr, ok := err.(*googleapi.Error); ok && gerr.Code == 403 {
        return fmt.Errorf("missing compute.subnetworks.list on %s/%s", project, region)
    }
}

func isGCEAPIError(err error) (*googleapi.Error, bool) {
    var gerr *googleapi.Error
    return gerr, errors.As(err, &gerr)
}

if err := deleteCluster(ctx, c); err != nil {
    var gerr *googleapi.Error
    if errors.As(err, &gerr) && (gerr.Code == 429 || gerr.Code >= 500) {
        // transient — retry with backoff
    }
    return err
}

When it happens

Trigger: c.Compute().Subnetworks().List(ctx, project, region) fails with 403 missing subnetworks.list, 429 quota, 5xx, or an invalid region (empty/mistyped c.Region() in the cluster spec).

Common situations: Region misconfiguration in the cluster spec; shared VPC where kops credentials lack subnet visibility in the host project; IAM role changes; transient GCP API outage during kops delete cluster.

Related errors

• error listing Routes: %w
• error listing Addresses: %v
• error getting ForwardingRule %q: %w
• error getting TargetPool %q: %w
• error listing InstanceGroupManagers: %v

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/61c4e40a233f9765. Report an issue: GitHub.