kubernetes/kops · error

listing forwardingRules: %w

Error message

listing forwardingRules: %w

What it means

FindDeletions lists all regional forwarding rules via ForwardingRules().List to decide which prune-candidate rules (e.pruneForwardingRules) should be deleted. This error wraps a List API failure and aborts deletion detection.

Source

Thrown at upup/pkg/fi/cloudup/gcetasks/forwardingrule.go:353

func (e *ForwardingRule) TerraformLink() *terraformWriter.Literal {
	name := fi.ValueOf(e.Name)

	return terraformWriter.LiteralSelfLink("google_compute_forwarding_rule", name)
}

var _ fi.CloudupProducesDeletions = (*ForwardingRule)(nil)

// FindDeletions implements fi.HasDeletions
func (e *ForwardingRule) FindDeletions(c *fi.CloudupContext) ([]fi.CloudupDeletion, error) {
	var removals []fi.CloudupDeletion

	if len(e.pruneForwardingRules) != 0 {
		ctx := c.Context()
		cloud := c.T.Cloud.(gce.GCECloud)

		forwardingRules, err := cloud.Compute().ForwardingRules().List(ctx, cloud.Project(), cloud.Region())
		if err != nil {
			return nil, fmt.Errorf("listing forwardingRules: %w", err)
		}

		for _, forwardingRule := range forwardingRules {
			prune := false

			for _, rule := range e.pruneForwardingRules {
				if rule.Name == forwardingRule.Name {
					prune = true
				}
			}

			if prune {
				removals = append(removals, &deleteForwardingRule{forwardingRule: forwardingRule})
			}
		}
	}

	return removals, nil

View on GitHub (pinned to 4c8573c808)

Solutions

1. Check the wrapped cause: fix auth (gcloud auth / service-account key), region, or project as indicated
2. Re-run `kops update cluster` after transient API issues — deletion detection is re-computed each run
3. Verify compute.forwardingRules.list IAM permission for the kOps service account
4. Check `gcloud compute forwarding-rules list --regions=<region>` manually to confirm access

Example fix

null

// pre-flight permission/region check
cmd := exec.Command("gcloud", "compute", "forwarding-rules", "list", "--project", project, "--regions", region, "--format", "value(name)")
if err := cmd.Run(); err != nil {
    return fmt.Errorf("cannot list forwarding rules in %s/%s: %w", project, region, err)
}

forwardingRules, err := cloud.Compute().ForwardingRules().List(ctx, project, region)
if err != nil {
    if isTransient(err) { // 429/5xx: backoff and retry before giving up
        return retryWithBackoff(func() error { return listAndPrune() })
    }
    return nil, fmt.Errorf("listing forwardingRules: %w", err)
}

When it happens

Trigger: pruneForwardingRules is non-empty (e.g. load balancer mode changed and old rules should be removed) and ForwardingRules().List(ctx, project, region) fails — quota/auth/API errors, wrong region/project, or network issues.

Common situations: Expired or revoked service-account credentials; region misconfiguration listing an inaccessible project; transient GCE outage; API rate limiting during large updates.

Related errors

• deleting forwardingRule %s: %w
• error deleting Subnetwork %s: %v
• error deleting router %s: %v
• error deleting ServiceAccount %s: %v
• error deleting network %s: %v

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/9cf4895ee0ffc8a0. Report an issue: GitHub.