kubernetes/kops · error

getting FirewallRule %q: %w

Error message

getting FirewallRule %q: %w

What it means

The GCE FirewallRule task's Find method fetches the firewall rule by name via Compute().Firewalls().Get; any error that is not a GCE notFound is wrapped with this message. It means existence could not be determined due to an API/permission failure, not that the rule is absent.

Source

Thrown at upup/pkg/fi/cloudup/gcetasks/firewallrule.go:71

	Disabled bool
}

var _ fi.CompareWithID = (*FirewallRule)(nil)
var _ fi.CloudupTaskNormalize = (*FirewallRule)(nil)

func (e *FirewallRule) CompareWithID() *string {
	return e.Name
}

func (e *FirewallRule) Find(c *fi.CloudupContext) (*FirewallRule, error) {
	cloud := c.T.Cloud.(gce.GCECloud)

	r, err := cloud.Compute().Firewalls().Get(cloud.Project(), *e.Name)
	if err != nil {
		if gce.IsNotFound(err) {
			return nil, nil
		}
		return nil, fmt.Errorf("getting FirewallRule %q: %w", *e.Name, err)
	}

	actual := &FirewallRule{}
	actual.Name = &r.Name
	actual.Network = &Network{Name: new(lastComponent(r.Network))}
	actual.TargetTags = r.TargetTags
	actual.SourceRanges = r.SourceRanges
	actual.SourceTags = r.SourceTags
	actual.Disabled = r.Disabled
	for _, a := range r.Allowed {
		actual.Allowed = append(actual.Allowed, serializeFirewallAllowed(a))
	}

	// Ignore "system" fields
	actual.Lifecycle = e.Lifecycle
	actual.Family = e.Family

	return actual, nil

View on GitHub (pinned to 4c8573c808)

Solutions

1. Check the wrapped error status for permission vs rate-limit causes
2. Grant the service account compute.firewalls.get (or compute.viewer) role
3. Retry after GCP API rate limits/backoff clear
4. Verify project ID in the kops cluster config is correct

// preflight IAM check
_, err := computeService.Firewalls.Get(project, name).Do()
// 403 => fix roles before running kops

r, err := firewalls.Get(project, name).Do()
if err != nil {
  if isNotFound(err) { return nil, nil }
  if isRateLimit(err) { backoffAndRetry() }
  return nil, fmt.Errorf("getting firewall rule: %w", err)
}

When it happens

Trigger: cloud.Compute().Firewalls().Get(cloud.Project(), *e.Name) returns an error that fails gce.IsNotFound — e.g. 403 permissionDenied, 429 rate limit, 500 backend error, or network failure.

Common situations: Service account lacks compute.firewalls.get permission; GCP API rate limiting during large cluster reconciliation; transient GCP outage during kops get/cluster read.

Related errors

• error deleting FirewallRule %s: %v
• error reading created Disk: %v
• either SourceRanges or SourceTags should be specified when D
• SourceRanges and SourceTags should not both be specified
• sourceRange %q is not valid: %w

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/c269bcdbe3f7d7c6. Report an issue: GitHub.