kubernetes/kops · error

error listing zones: %v

Error message

error listing zones: %v

What it means

ListResourcesGCE lists all compute zones in the GCE project via the cloud provider's Compute().Zones().List call; any failure is wrapped as 'error listing zones: %v'. Zone discovery is the first step of GCE resource listing, so this failure aborts the entire listing operation.

Source

Thrown at pkg/resources/gce/gce.go:80

func ListResourcesGCE(gceCloud gce.GCECloud, clusterInfo resources.ClusterInfo) (map[string]*resources.Resource, error) {
	clusterName := clusterInfo.Name

	ctx := context.TODO()
	region := gceCloud.Region()
	allResources := make(map[string]*resources.Resource)

	d := &clusterDiscoveryGCE{
		cloud:       gceCloud,
		gceCloud:    gceCloud,
		clusterName: clusterName,
	}

	{
		// TODO: Only zones in api.Cluster object, if we have one?
		gceZones, err := d.gceCloud.Compute().Zones().List(ctx, d.gceCloud.Project())
		if err != nil {
			return nil, fmt.Errorf("error listing zones: %v", err)
		}
		for _, gceZone := range gceZones {
			u, err := gce.ParseGoogleCloudURL(gceZone.Region)
			if err != nil {
				return nil, err
			}
			if u.Name != region {
				continue
			}
			d.zones = append(d.zones, gceZone.Name)
		}
		if len(d.zones) == 0 {
			return nil, fmt.Errorf("unable to determine zones in region %q", region)
		}
		klog.Infof("Scanning zones: %v", d.zones)
	}

	listFunctions := []gceListFn{

View on GitHub (pinned to 4c8573c808)

Solutions

1. Verify credentials: run 'gcloud compute zones list --project <project>' with the same identity kops uses; fix GOOGLE_APPLICATION_CREDENTIALS or 'gcloud auth application-default login' if it fails.
2. Enable the Compute Engine API for the project (gcloud services enable compute.googleapis.com).
3. Grant the service account roles/compute.viewer (at minimum compute.zones.list) on the project.
4. Confirm the project ID passed to kops matches an existing GCP project; check the wrapped error for 401/403/404 specifics.

Example fix

// before
gceZones, err := d.gceCloud.Compute().Zones().List(ctx, d.gceCloud.Project())
if err != nil {
	return nil, fmt.Errorf("error listing zones: %v", err)
}
// after
gceZones, err := d.gceCloud.Compute().Zones().List(ctx, d.gceCloud.Project())
if err != nil {
	return nil, fmt.Errorf("error listing zones in project %q: %w", d.gceCloud.Project(), err)
}

// preflight with gcloud using the same identity kops uses:
// gcloud auth application-default print-access-token
// gcloud compute zones list --project <project> --limit=1

func hasComputeScope(creds *google.Credentials) bool {
	for _, s := range creds.Scopes {
		if s == compute.CloudPlatformScope || s == compute.ComputeScope {
			return true
		}
	}
	return false
}

gceZones, err := d.gceCloud.Compute().Zones().List(ctx, d.gceCloud.Project())
if err != nil {
	var eg *googleapi.Error
	if errors.As(err, &eg) {
		switch eg.Code {
		case http.StatusUnauthorized, http.StatusForbidden:
			// fix credentials / IAM roles
		case http.StatusNotFound:
			// enable Compute Engine API or fix project ID
		}
	}
	return nil, fmt.Errorf("error listing zones: %w", err)
}

When it happens

Trigger: Zones().List(ctx, project) fails: invalid GCP credentials or missing compute scope on the service account, project ID wrong, Compute Engine API not enabled, quota/network errors, or expired gcloud auth (user ADC).

Common situations: Running 'kops toolbox dump'/'kops get' on a GCE cluster with GOOGLE_APPLICATION_CREDENTIALS pointing at a stale key, service account without compute.viewer role, or Compute API disabled in a brand-new project.

Related errors

• creating gce IPAM controller: %w
• error building compute API client: %v
• failed to list vpcs: %v
• unable to determine zones in region %q
• error getting ForwardingRule %q: %w

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/dae96e635ebcd021. Report an issue: GitHub.