kubernetes/kops · error

setting ForwardingRule labels: %w

Error message

setting ForwardingRule labels: %w

What it means

During creation, the SetLabels API call for a newly created forwarding rule failed. The label fingerprint was freshly fetched from Get, so failure usually indicates an API-level problem rather than a stale fingerprint.

Source

Thrown at upup/pkg/fi/cloudup/gcetasks/forwardingrule.go:251

		if err := t.Cloud.WaitForOp(op); err != nil {
			return fmt.Errorf("error creating forwarding rule: %v", err)
		}

		if e.Labels != nil {
			// We can't set labels on creation; we have to read the object to get the fingerprint
			// TODO: We could get it from the operation!
			r, err := t.Cloud.Compute().ForwardingRules().Get(ctx, t.Cloud.Project(), t.Cloud.Region(), name)
			if err != nil {
				return fmt.Errorf("reading created ForwardingRule %q: %v", name, err)
			}

			req := compute.RegionSetLabelsRequest{
				LabelFingerprint: r.LabelFingerprint,
				Labels:           e.Labels,
			}
			op, err := t.Cloud.Compute().ForwardingRules().SetLabels(ctx, t.Cloud.Project(), t.Cloud.Region(), o.Name, &req)
			if err != nil {
				return fmt.Errorf("setting ForwardingRule labels: %w", err)
			}

			if err := t.Cloud.WaitForOp(op); err != nil {
				return fmt.Errorf("setting ForwardRule labels: %w", err)
			}
		}
	} else {
		if changes.Labels != nil {
			req := compute.RegionSetLabelsRequest{
				LabelFingerprint: a.labelFingerprint,
				Labels:           e.Labels,
			}
			op, err := t.Cloud.Compute().ForwardingRules().SetLabels(ctx, t.Cloud.Project(), t.Cloud.Region(), o.Name, &req)
			if err != nil {
				return fmt.Errorf("setting ForwardingRule labels: %w", err)
			}

			if err := t.Cloud.WaitForOp(op); err != nil {

View on GitHub (pinned to 4c8573c808)

Solutions

1. Validate label keys/values against GCE constraints (lowercase, hyphens/underscores, ≤63 chars)
2. Check IAM permission compute.forwardingRules.setLabels for the kOps service account
3. Re-run kops update to retry; on fingerprint conflicts the new run re-fetches the fingerprint
4. Inspect the wrapped error for the exact GCE API reason

Example fix

// before: invalid label value
labels: {"Kops.k8s.io/Cluster": "my.Cluster.example.com"}

// after: normalized value
labels: {"kops-k8s-io-cluster": "my-cluster-example-com"}

// validate labels against GCE constraints before calling SetLabels
func validGCELabels(labels map[string]string) bool {
    re := regexp.MustCompile(`^[a-z0-9_-]{1,63}$`)
    if len(labels) > 64 { return false }
    for k, v := range labels {
        if !re.MatchString(k) || !re.MatchString(v) { return false }
    }
    return true
}

op, err := cloud.Compute().ForwardingRules().SetLabels(ctx, project, region, name, &req)
if err != nil {
    var gerr *googleapi.Error
    if errors.As(err, &gerr) && gerr.Code == 412 { // precondition: fingerprint changed
        return refreshFingerprintAndRetry()
    }
    return fmt.Errorf("setting ForwardingRule labels: %w", err)
}

When it happens

Trigger: ForwardingRules().SetLabels(ctx, project, region, o.Name, &req) returns an error right after creation: invalid label keys/values, permission denied, or API failure.

Common situations: Label keys/values violating GCE rules (uppercase, >63 chars, invalid characters); service account lacking compute.forwardingRules.setLabels; region quota of labels exceeded; concurrent fingerprint change.

Related errors

• error creating ForwardingRule %q: %v
• reading created ForwardingRule %q: %v
• setting ForwardRule labels: %w
• error fetching GCE instance: %w
• error fetching GCE instance group template %q: %v

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/a8c4d495688005a1. Report an issue: GitHub.