kubernetes/kops · error

error updating IAM for project %s: %w

Error message

error updating IAM for project %s: %w

What it means

Wrapped error from ProjectIAMBinding.RenderGCE when CloudResourceManager Projects.SetIamPolicy fails after the policy patch was computed. Commonly caused by concurrent policy modifications (etag conflict) despite the local mutex, or missing setIamPolicy permission.

Source

Thrown at upup/pkg/fi/cloudup/gcetasks/projectiambinding.go:131

	localMutex.Lock()
	defer localMutex.Unlock()

	request := &cloudresourcemanager.GetIamPolicyRequest{}
	policy, err := t.Cloud.CloudResourceManager().Projects.GetIamPolicy(projectID, request).Context(ctx).Do()
	if err != nil {
		return fmt.Errorf("error getting IAM policy for project %s: %w", projectID, err)
	}

	changed := patchCRMPolicy(policy, member, role)

	if !changed {
		klog.Warningf("did not need to change policy (concurrent change?)")
		return nil
	}

	klog.V(2).Infof("updating IAM for project %s", projectID)
	if _, err := t.Cloud.CloudResourceManager().Projects.SetIamPolicy(projectID, &cloudresourcemanager.SetIamPolicyRequest{Policy: policy}).Context(ctx).Do(); err != nil {
		return fmt.Errorf("error updating IAM for project %s: %w", projectID, err)
	}

	return nil
}

// terraformProjectIAMBinding is the model for a terraform google_project_iam_binding rule
type terraformProjectIAMBinding struct {
	Project string                     `cty:"project"`
	Role    string                     `cty:"role"`
	Members []*terraformWriter.Literal `cty:"members"`
}

func (_ *ProjectIAMBinding) RenderTerraform(t *terraform.TerraformTarget, a, e, changes *ProjectIAMBinding) error {
	tf := &terraformProjectIAMBinding{
		Project: fi.ValueOf(e.Project),
		Role:    fi.ValueOf(e.Role),
		Members: []*terraformWriter.Literal{e.MemberServiceAccount.TerraformLink_Member()},
	}

View on GitHub (pinned to 4c8573c808)

Solutions

1. Retry the apply — concurrent-modification conflicts usually self-heal on the next run
2. Check for other automation editing the project's IAM policy at the same time
3. Verify resourcemanager.projects.setIamPolicy permission

When it happens

Trigger: Thrown at upup/pkg/fi/cloudup/gcetasks/projectiambinding.go:131 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/b3d0f2029c3a4bb2. Report an issue: GitHub.