Troubleshoot cluster creation

Failures during Google Kubernetes Engine (GKE) cluster creation can prevent you from provisioning necessary infrastructure. Common causes for failures are violations of the constraints/compute.vmExternalIpAccess or constraints/compute.restrictVpcPeering organization policies. Use this page to help you troubleshoot and resolve cluster creation failures caused by these organization policies.

This information is important for Platform admins and operators or other users responsible for creating and managing GKE clusters within a Google Cloud organization. For more information about the common roles and example tasks that we reference in Google Cloud content, see Common GKE user roles and tasks.

For general issues with a Kubernetes cluster, see Troubleshooting Clusters in the Kubernetes documentation.

Error: Constraint constraints/compute.vmExternalIpAccess violated

An error similar to the following can occur when you try to create a public GKE cluster:

Constraint constraints/compute.vmExternalIpAccess violated for project

This only affects public GKE clusters, including GKE Autopilot clusters.

When you create public GKE clusters, the underlying Compute Engine VMs, which make up the worker nodes of this cluster, have external IP addresses assigned. If you configure the organization policy constraint constraints/compute.vmExternalIpAccess to Deny All or to restrict external IP addresses to specific VM instances at the organization, folder, or project level, then the policy prevents the GKE worker nodes from obtaining external IP addresses, which results in cluster creation failure.

To find the logs of the cluster creation operation, you can review the GKE Cluster Operations Audit Logs using Logs Explorer with a search query similar to the following:

resource.type="gke_cluster"
logName="projects/test-last-gke-sa/logs/cloudaudit.googleapis.com%2Factivity"
protoPayload.methodName="google.container.v1beta1.ClusterManager.CreateCluster"
resource.labels.cluster_name="CLUSTER_NAME"
resource.labels.project_id="PROJECT_ID"

Replace the following:

  • CLUSTER_NAME: the name of the cluster that wasn't created.
  • PROJECT_ID: your project ID.

To resolve this issue, ensure that the effective policy for the constraint constraints/compute.vmExternalIpAccess is Allow All on the project where you are trying to create a GKE public cluster. For information on working with this constraint, see Restricting external IP addresses to specific VM instances.

After setting the constraint to Allow All, delete the failed cluster and create a new cluster. This is required because repairing the failed cluster is not possible.

Error: Constraint constraints/compute.restrictVpcPeering violated

An error similar to the following can occur when you try to create a private GKE cluster that uses VPC Network Peering to connect your VPC network to the Google-managed control plane project:

Constraint constraints/compute.restrictVpcPeering violated for project

If you configure the constraints/compute.restrictVpcPeering organization policy constraint on the organization, folder, or project that owns the cluster's VPC network, the policy blocks GKE from peering the control plane VPC network with your VPC network unless the Google-managed producer hierarchy is allowed.

To resolve this issue, use one of the following options:

  • Create a cluster that uses Private Service Connect for control plane connectivity instead of VPC Network Peering.
  • Update the constraints/compute.restrictVpcPeering policy on the project, folder, or organization that owns the cluster's VPC network to add the Google service producer organization (under:organizations/433637338589) to the allowedValues field.

After updating the organization policy, delete the failed cluster and create a new cluster.

What's next