Error map

Kubernetes cluster unreachable (provider/helm) Terraform: Error: Kubernetes cluster unreachable: Get "http://localhost/version": dial tcp 127.0.0.1:80: connect: connection refused

Terraform · layer 6, Platform & cloud

Open the full error page →

Centre: this error. First ring: errors it is linked with (9). Outer ring: what those are linked with. Colours show the layer of a request each error belongs to. Click any dot to re-centre the map on it; hover to follow its connections. The centre dot opens the error page.

Kubernetes cluster unreachable (provider/helm) — Terraform: Error: Kubernetes cluster unreachable: Get "http://localhost/version": dial tcp 127.0.0.1:80: connect: connection refused (Terraform)Kubernetes …cannot re-use a name that is still in use — Error: INSTALLATION FAILED: cannot re-use a name that is still in use (Kubernetes)cannot re-use a nam…another operation is in progress — Error: UPGRADE FAILED: another operation (install/upgrade/rollback) is in progress (Kubernetes)another operation i…invalid ownership metadata — rendered manifests contain a resource that already exists. Unable to continue with install: ... invalid ownership metadata (Kubernetes)invalid ownership m…Failed to install provider (download failed) — Terraform: Error: Failed to install provider — Error while installing hashicorp/aws v5.40.0: could not query provider registry / Get "https://releases.hashicorp.com/...": dial tcp: i/o timeout (Terraform)Failed to install p…Error building ARM Config: obtain subscription from Azure CLI — Terraform: Error: building AzureRM Client: obtaining subscription ID / Please run 'az login' to setup account (Terraform)Error building ARM …Invalid AWS Region — Terraform: Error: Invalid AWS Region: us-east-3 / Error: configuring Terraform AWS Provider: validating provider credentials: operation error STS: GetCallerIdentity (Terraform)Invalid AWS RegionBackend configuration changed (migrate or reconfigure) — Terraform: Error: Backend configuration changed — A change in the backend configuration has been detected, which may require migrating existing state (Terraform)Backend configurati…No valid credential sources found (AWS provider) — Terraform: Error: No valid credential sources found — failed to refresh cached credentials, no EC2 IMDS role found / Error: configuring Terraform AWS Provider: no valid credential sources (Terraform)No valid credential…UnauthorizedOperation / AccessDenied during Terraform apply — Terraform: Error: creating EC2 Instance: UnauthorizedOperation: You are not authorized to perform this operation. User: arn:aws:iam::123:user/ci is not authorized to perform: ec2:RunInstances (Terraform)UnauthorizedOperati…CrashLoopBackOff — Kubernetes: CrashLoopBackOff (Kubernetes)CrashLoopBackOffCreateContainerConfigError — Kubernetes: CreateContainerConfigError — secret / configmap not found (Kubernetes)CreateContainerConf…CreateContainerError — Pod status CreateContainerError (Kubernetes)CreateContainerErrorgithub-actions[bot] 403 — remote: Permission to owner/repo.git denied to github-actions[bot]. fatal: unable to access … The requested URL returned error: 403 (Git)github-actions[bot]…No updates are to be performed — CloudFormation: No updates are to be performed (AWS)No updates are to b…toomanyrequests — toomanyrequests: You have reached your pull rate limit (Docker Hub) (Docker)toomanyrequestsAlreadyExists — Error from server (AlreadyExists): ... already exists (Kubernetes)AlreadyExistsis waiting to start — Error from server (BadRequest): container "x" in pod "y" is waiting to start: ContainerCreating (Kubernetes)is waiting to startadmission webhook denied the request — Error from server: admission webhook "validate.nginx.ingress.kubernetes.io" denied the request (Kubernetes)admission webhook d…Client.Timeout exceeded — Get "https://registry-1.docker.io/v2/": net/http: request canceled while waiting for connection (Client.Timeout exceeded) (Docker)Client.Timeout exce…lookup registry-1.docker.io: no such host — dial tcp: lookup registry-1.docker.io: no such host / Temporary failure in name resolution during docker build (Docker)lookup registry-1.d…Unable to connect to the server: dial tcp i/o timeout — Unable to connect to the server: dial tcp <ip>:443: i/o timeout (Kubernetes)Unable to connect t…ExpiredToken — AWS: ExpiredToken — The security token included in the request is expired (AWS)ExpiredTokenNoCredentialsError — AWS: Unable to locate credentials / Could not load credentials from any providers (AWS)NoCredentialsErrorSignatureDoesNotMatch — AWS: SignatureDoesNotMatch / InvalidClientTokenId — the request signature we calculated does not match (AWS)SignatureDoesNotMat…PermanentRedirect — S3 PermanentRedirect: The bucket you are attempting to access must be addressed using the specified endpoint (AWS)PermanentRedirectInvalidKeyPair.NotFound — InvalidKeyPair.NotFound: The key pair 'x' does not exist (AWS)InvalidKeyPair.NotF…InvalidAMIID.NotFound — InvalidAMIID.NotFound: The image id '[ami-xxxx]' does not exist (AWS)InvalidAMIID.NotFou…Error acquiring the state lock — Terraform: Error: Error acquiring the state lock — ConditionalCheckFailedException / state blob is already locked (Terraform)Error acquiring the…state snapshot was created by a newer Terraform version — Terraform: Error: state snapshot was created by Terraform v1.9.0, which is newer than current v1.6.6; upgrade to Terraform v1.9.0 or greater to work with this state (Terraform)state snapshot was …Backend initialization required — Terraform: Error: Backend initialization required, please run "terraform init" — Reason: Initial configuration of the requested backend "s3" (Terraform)Backend initializat…UnrecognizedClientException — UnrecognizedClientException: The security token included in the request is invalid (AWS)UnrecognizedClientE…Credentials could not be loaded — GitHub Actions: Error: Credentials could not be loaded, please check your action inputs: Could not load credentials from any providers (CI/CD)Credentials could n…Could not find credentials entry — Jenkins: ERROR: Could not find credentials entry with ID 'github-token' (CI/CD)Could not find cred…IAM AccessDeniedException — AccessDeniedException: User: arn:aws:iam::... is not authorized to perform: service:Action on resource: ... (AWS)IAM AccessDeniedExc…sts:AssumeRole denied — is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::...:role/... (AWS)sts:AssumeRole deni…Cloud Run 403: Your client does not have permission to get URL — Cloud Run: Error: Forbidden — Your client does not have permission to get URL / from this server (Google Cloud / Firebase)Cloud Run 403: Your…

Directly related (9)

cannot re-use a name that is still in useKubernetes

Error: INSTALLATION FAILED: cannot re-use a name that is still in use

helm install was run with a release name that already exists in the namespace (even a failed one).

another operation is in progressKubernetes

Error: UPGRADE FAILED: another operation (install/upgrade/rollback) is in progress

A previous Helm operation on this release was interrupted and left it in a pending-install/pending-upgrade state, so Helm refuses…

invalid ownership metadataKubernetes

rendered manifests contain a resource that already exists. Unable to continue with install: ... invalid ownership metadata

Helm wants to create an object that already exists but isn’t labelled as belonging to this release.

Failed to install provider (download failed)Terraform

Terraform: Error: Failed to install provider — Error while installing hashicorp/aws v5.40.0: could not query provider registry / Get "https://releases.hashicorp.com/...": dial tcp: i/o timeout

Terraform found the provider version but couldn't download/verify the package.

Error building ARM Config: obtain subscription from Azure CLITerraform

Terraform: Error: building AzureRM Client: obtaining subscription ID / Please run 'az login' to setup account

The AzureRM provider can't find Azure credentials or a subscription.

Invalid AWS RegionTerraform

Terraform: Error: Invalid AWS Region: us-east-3 / Error: configuring Terraform AWS Provider: validating provider credentials: operation error STS: GetCallerIdentity

The `region` is invalid/unavailable, or the provider can't reach AWS endpoints to validate credentials.

Backend configuration changed (migrate or reconfigure)Terraform

Terraform: Error: Backend configuration changed — A change in the backend configuration has been detected, which may require migrating existing state

The saved backend settings in `.terraform` differ from the current configuration.

No valid credential sources found (AWS provider)Terraform

Terraform: Error: No valid credential sources found — failed to refresh cached credentials, no EC2 IMDS role found / Error: configuring Terraform AWS Provider: no valid credential sources

The AWS provider found no credentials (env vars, shared config, SSO, role, instance profile).

UnauthorizedOperation / AccessDenied during Terraform applyTerraform

Terraform: Error: creating EC2 Instance: UnauthorizedOperation: You are not authorized to perform this operation. User: arn:aws:iam::123:user/ci is not authorized to perform: ec2:RunInstances

The IAM identity used by Terraform lacks a permission needed for that resource.

Two steps away (27)

CrashLoopBackOffKubernetes

Kubernetes: CrashLoopBackOff

The container starts, crashes (or exits), and Kubernetes keeps restarting it with increasing back-off delays.

CreateContainerConfigErrorKubernetes

Kubernetes: CreateContainerConfigError — secret / configmap not found

Kubernetes can’t build the container’s configuration — usually a referenced Secret, ConfigMap or key doesn’t exist in that namesp…

CreateContainerErrorKubernetes

Pod status CreateContainerError

The image was pulled, but the container runtime failed to create the container — bad command, missing mount target, or a name/vol…

github-actions[bot] 403Git

remote: Permission to owner/repo.git denied to github-actions[bot]. fatal: unable to access … The requested URL returned error: 403

A GitHub Actions workflow tried to push but the GITHUB_TOKEN doesn’t have write permission.

No updates are to be performedAWS

CloudFormation: No updates are to be performed

You ran an update/deploy with a template and parameters identical to what’s deployed, so there’s nothing to change.

toomanyrequestsDocker

toomanyrequests: You have reached your pull rate limit (Docker Hub)

Docker Hub limits anonymous and free pulls; your IP or account has used its quota for the current window.

AlreadyExistsKubernetes

Error from server (AlreadyExists): ... already exists

kubectl create tried to make an object whose name is already taken in that namespace.

is waiting to startKubernetes

Error from server (BadRequest): container "x" in pod "y" is waiting to start: ContainerCreating

kubectl logs has nothing to show yet — the container hasn’t started (still creating, pulling, or blocked).

admission webhook denied the requestKubernetes

Error from server: admission webhook "validate.nginx.ingress.kubernetes.io" denied the request

A validating admission webhook (ingress-nginx, Gatekeeper/OPA, Kyverno) inspected your object and rejected it; the reason follows…

Client.Timeout exceededDocker

Get "https://registry-1.docker.io/v2/": net/http: request canceled while waiting for connection (Client.Timeout exceeded)

Docker couldn’t reach the registry in time — a network, DNS, proxy or firewall problem between your machine and the registry.

lookup registry-1.docker.io: no such hostDocker

dial tcp: lookup registry-1.docker.io: no such host / Temporary failure in name resolution during docker build

DNS isn’t working for the Docker daemon or inside build containers, so pulls and package downloads fail.

Unable to connect to the server: dial tcp i/o timeoutKubernetes

Unable to connect to the server: dial tcp <ip>:443: i/o timeout

kubectl can’t reach the API server at all — network path, VPN, firewall or a private endpoint you’re outside of.

ExpiredTokenAWS

AWS: ExpiredToken — The security token included in the request is expired

Temporary AWS credentials (STS/SSO/assumed role) have expired.

NoCredentialsErrorAWS

AWS: Unable to locate credentials / Could not load credentials from any providers

The AWS CLI/SDK found no credentials in any place it looks — env vars, profile files, SSO cache or an instance/task role.

SignatureDoesNotMatchAWS

AWS: SignatureDoesNotMatch / InvalidClientTokenId — the request signature we calculated does not match

AWS rejected the request signature — wrong secret key, wrong region, clock skew, or a presigned URL used differently from how it…

PermanentRedirectAWS

S3 PermanentRedirect: The bucket you are attempting to access must be addressed using the specified endpoint

The request went to the wrong S3 region/endpoint for that bucket.

InvalidKeyPair.NotFoundAWS

InvalidKeyPair.NotFound: The key pair 'x' does not exist

The key pair name you passed doesn’t exist in that region (key pairs are regional).

InvalidAMIID.NotFoundAWS

InvalidAMIID.NotFound: The image id '[ami-xxxx]' does not exist

The AMI ID isn’t available in this region/account — AMI IDs are regional and private AMIs must be shared.

Error acquiring the state lockTerraform

Terraform: Error: Error acquiring the state lock — ConditionalCheckFailedException / state blob is already locked

Another Terraform run holds the state lock, or a previous run crashed and left the lock behind.

state snapshot was created by a newer Terraform versionTerraform

Terraform: Error: state snapshot was created by Terraform v1.9.0, which is newer than current v1.6.6; upgrade to Terraform v1.9.0 or greater to work with this state

The remote/local state was last written by a newer Terraform CLI than the one you're running.

Backend initialization requiredTerraform

Terraform: Error: Backend initialization required, please run "terraform init" — Reason: Initial configuration of the requested backend "s3"

Terraform needs `terraform init` to set up the backend (new directory, changed backend config, missing `.terraform`).

UnrecognizedClientExceptionAWS

UnrecognizedClientException: The security token included in the request is invalid

The access key or session token isn’t recognised — wrong/deleted key, a session token missing for temporary credentials, or a reg…

Credentials could not be loadedCI/CD

GitHub Actions: Error: Credentials could not be loaded, please check your action inputs: Could not load credentials from any providers

`aws-actions/configure-aws-credentials` found no usable credentials — no keys, no role to assume, or the OIDC token was not reque…

Could not find credentials entryCI/CD

Jenkins: ERROR: Could not find credentials entry with ID 'github-token'

The Jenkinsfile references a credentials ID that does not exist in the scope Jenkins can see for this job.

IAM AccessDeniedExceptionAWS

AccessDeniedException: User: arn:aws:iam::... is not authorized to perform: service:Action on resource: ...

The IAM user or role making the call has no permission for that action on that resource — the message names both.

sts:AssumeRole deniedAWS

is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::...:role/...

The caller can’t assume the role — either its own policy doesn’t allow sts:AssumeRole, or the role’s trust policy doesn’t trust t…

Cloud Run 403: Your client does not have permission to get URLGoogle Cloud / Firebase

Cloud Run: Error: Forbidden — Your client does not have permission to get URL / from this server

The Cloud Run service requires authentication and the caller has no valid identity token or the `roles/run.invoker` role.