kubernetes/kops · error

reading created ForwardingRule %q: %v

Error message

reading created ForwardingRule %q: %v

What it means

After creating a forwarding rule, kOps must read it back to obtain the label fingerprint (GCE labels cannot be set at creation). This error wraps a failure of that ForwardingRules().Get call on a resource that was just created.

Source

Thrown at upup/pkg/fi/cloudup/gcetasks/forwardingrule.go:242

	if a == nil {
		klog.V(4).Infof("Creating ForwardingRule %q", o.Name)

		op, err := t.Cloud.Compute().ForwardingRules().Insert(ctx, t.Cloud.Project(), t.Cloud.Region(), o)
		if err != nil {
			return fmt.Errorf("error creating ForwardingRule %q: %v", o.Name, err)
		}

		if err := t.Cloud.WaitForOp(op); err != nil {
			return fmt.Errorf("error creating forwarding rule: %v", err)
		}

		if e.Labels != nil {
			// We can't set labels on creation; we have to read the object to get the fingerprint
			// TODO: We could get it from the operation!
			r, err := t.Cloud.Compute().ForwardingRules().Get(ctx, t.Cloud.Project(), t.Cloud.Region(), name)
			if err != nil {
				return fmt.Errorf("reading created ForwardingRule %q: %v", name, err)
			}

			req := compute.RegionSetLabelsRequest{
				LabelFingerprint: r.LabelFingerprint,
				Labels:           e.Labels,
			}
			op, err := t.Cloud.Compute().ForwardingRules().SetLabels(ctx, t.Cloud.Project(), t.Cloud.Region(), o.Name, &req)
			if err != nil {
				return fmt.Errorf("setting ForwardingRule labels: %w", err)
			}

			if err := t.Cloud.WaitForOp(op); err != nil {
				return fmt.Errorf("setting ForwardRule labels: %w", err)
			}
		}
	} else {
		if changes.Labels != nil {
			req := compute.RegionSetLabelsRequest{

View on GitHub (pinned to 4c8573c808)

Solutions

1. Re-run kops update — the rule now exists and the next pass will only set labels
2. Check IAM permissions for the service account (compute.forwardingRules.get)
3. Retry after a short delay if it was an eventual-consistency 404
4. Verify project/region are correct in the kOps cluster spec

Example fix

null

null

r, err := cloud.Compute().ForwardingRules().Get(ctx, project, region, name)
if err != nil {
    if isNotFound(err) {
        // eventual consistency right after creation: brief backoff then retry once
        time.Sleep(2 * time.Second)
        r, err = cloud.Compute().ForwardingRules().Get(ctx, project, region, name)
    }
    if err != nil {
        return fmt.Errorf("reading created ForwardingRule %q: %v", name, err)
    }
}

When it happens

Trigger: Labels are set on the task (e.Labels != nil), creation succeeded, but ForwardingRules().Get(ctx, project, region, name) fails — typically propagation delay (the resource is not yet visible via Get), a permission error, or a transient API error.

Common situations: GCE eventual-consistency: Get immediately after operation completion occasionally 404s; IAM changes revoked compute.viewer; regional mismatch if project/region resolution changed.

Related errors

• setting ForwardingRule labels: %w
• setting ForwardRule labels: %w
• cannot decode GCE label: %q
• error setting labels on created Disk: %v
• Specified both IP Address and rule-managed IP address: %v, %

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/d33eab4797e1c385. Report an issue: GitHub.