How to fix Error: Error creating GKE Cluster: BadRequest in Terraform

TerraformINTERMEDIATEHIGHUpdated Dec 31, 2025· 100 views

A 400 BadRequest error occurs when creating a GKE cluster with Terraform due to invalid network configuration, missing permissions, or incompatible cluster settings. This error typically indicates a configuration validation failure on the Google Cloud API side.

Quick fix

Fixes Error: Error creating GKE Cluster: BadRequest

resource "google_container_cluster" "primary" {
  name       = "my-cluster"
  location   = "us-central1"
  network    = google_compute_network.vpc.name
  subnetwork = google_compute_subnetwork.subnet.name

  ip_allocation_policy {
    cluster_secondary_range_name  = "pods"
    services_secondary_range_name = "services"
  }
}
  1. Verify and configure the VPC network settings
  2. Enable Alias IPs for private clusters
  3. Review and fix IAM permissions for service accounts
  4. Remove reserved Kubernetes labels from cluster creation
terraform — error
resource "google_container_cluster" "primary" {
  name       = "my-cluster"
  location   = "us-central1"
  network    = google_compute_network.vpc.name
  subnetwork = google_compute_subnetwork.subnet.name
  ip_allocation_policy {
    cluster_secondary_range_name  = "pods"
    services_secondary_range_name = "services"
  }
}
Error: Error creating GKE Cluster: BadRequest

What this error means

The BadRequest error (HTTP 400) returned by Google Cloud's API indicates that your Terraform configuration has invalid or conflicting parameters that Google Cloud cannot accept. This is different from authentication errors—your credentials are valid, but the cluster configuration itself violates GCP constraints or prerequisites. The error requires careful review of networking, service accounts, and cluster settings.

Typical symptoms

  • Terraform plan succeeds but apply fails with BadRequest
  • Error message includes specific details like 'Alias IP addresses are required' or 'Subnetwork is not valid'
  • Cluster creation fails silently without being created in GCP Console
  • Different Terraform configurations fail with different BadRequest messages

Common causes

  1. Missing or invalid Alias IP configuration for private clusters
  2. Using a custom VPC network without specifying a valid subnetwork
  3. Specifying a subnetwork that doesn't exist in the chosen network
  4. Using reserved Kubernetes label prefixes (app.kubernetes.io/*) during cluster creation
  5. Insufficient IAM permissions to use the specified service account
  6. Attempting to enable Cloud Run addon on existing cluster (only at creation time)
  7. Workload Identity enabled on Windows node pools (not supported)

How to fix "Error: Error creating GKE Cluster: BadRequest"

1Verify and configure the VPC network settings

Ensure your network and subnetwork are properly configured. If using a custom VPC with custom-subnet mode, you must explicitly specify the subnetwork:

hcl
resource "google_container_cluster" "primary" {
  name       = "my-cluster"
  location   = "us-central1"
  network    = google_compute_network.vpc.name
  subnetwork = google_compute_subnetwork.subnet.name

  ip_allocation_policy {
    cluster_secondary_range_name  = "pods"
    services_secondary_range_name = "services"
  }
}

Verify that the subnetwork exists in the specified network using:

bash
gcloud compute networks subnets list --network=YOUR_NETWORK_NAME
2Enable Alias IPs for private clusters

If creating a private cluster, you must enable Alias IP addresses. The error 'Alias IP addresses are required for private cluster' indicates this is missing:

hcl
resource "google_container_cluster" "primary" {
  name     = "my-cluster"
  location = "us-central1"

  private_cluster_config {
    enable_private_nodes    = true
    enable_private_endpoint = true
    master_ipv4_cidr_block  = "172.16.0.0/28"
  }

  ip_allocation_policy {
    cluster_secondary_range_name  = "pods"
    services_secondary_range_name = "services"
  }
}

Ensure secondary IP ranges for pods and services exist in your subnetwork.

3Review and fix IAM permissions for service accounts

If you get 'The user does not have access to service account', ensure the service account exists and you have the iam.serviceAccountUser role. Either use a service account you have permissions for:

hcl
resource "google_container_cluster" "primary" {
  name     = "my-cluster"
  location = "us-central1"

  node_config {
    service_account = google_service_account.custom_sa.email
    oauth_scopes = [
      "https://www.googleapis.com/auth/cloud-platform",
    ]
  }
}

Or verify your default service account:

bash
gcloud iam service-accounts describe PROJECT_NUMBER-compute@developer.gserviceaccount.com
4Remove reserved Kubernetes labels from cluster creation

If creating a node pool fails with 'Applying kubernetes label is not allowed', remove reserved Kubernetes label prefixes during cluster creation:

hcl
resource "google_container_node_pool" "primary_nodes" {
  name       = "primary-node-pool"
  cluster    = google_container_cluster.primary.id
  node_count = 3

  node_config {
    # Do NOT use app.kubernetes.io/* labels here
    labels = {
      environment = "production"
      team        = "platform"
    }
  }
}

Apply reserved labels (app.kubernetes.io/*) after cluster creation using kubectl instead.

5Check Cloud Run and serverless addon configuration

The error 'Can only enable serverless at cluster creation time' means Cloud Run must be enabled during initial cluster creation, not after. If you need Cloud Run, add it upfront:

hcl
resource "google_container_cluster" "primary" {
  name     = "my-cluster"
  location = "us-central1"

  addons_config {
    cloudrun_config {
      disabled = false
    }
  }
}

Note: Once enabled, Cloud Run can be disabled, but cannot be re-enabled without recreating the cluster.

6Validate Windows node pool configuration

If creating Windows node pools, disable Workload Identity which is not supported on Windows:

hcl
resource "google_container_node_pool" "windows_nodes" {
  name    = "windows-pool"
  cluster = google_container_cluster.primary.id

  node_config {
    machine_type = "n1-standard-2"
    image_type   = "WINDOWS_SAC"

    workload_metadata_config {
      mode = "GCE_METADATA"
    }
  }
}

This sets metadata to GCE only, disabling Workload Identity on Windows nodes.

Advanced notes

BadRequest errors require examining the specific error message returned by Google Cloud's API—different messages indicate different root causes. Use terraform plan -out=plan.tfplan and terraform apply plan.tfplan to see the full error details. For persistent issues, enable debug logging: TF_LOG=DEBUG terraform apply to see API requests and responses. Google Cloud's quota and billing account status can also cause BadRequest errors; verify these in the GCP Console before debugging configuration.

Frequently asked questions

What does "Error: Error creating GKE Cluster: BadRequest" mean?
The BadRequest error (HTTP 400) returned by Google Cloud's API indicates that your Terraform configuration has invalid or conflicting parameters that Google Cloud cannot accept. This is different from authentication errors—your credentials are valid, but the cluster configuration itself violates GCP constraints or prerequisites. The error requires careful review of networking, service accounts, and cluster settings.
How do I fix "Error: Error creating GKE Cluster: BadRequest"?
A 400 BadRequest error occurs when creating a GKE cluster with Terraform due to invalid network configuration, missing permissions, or incompatible cluster settings. This error typically indicates a configuration validation failure on the Google Cloud API side.
What causes "Error: Error creating GKE Cluster: BadRequest"?
Missing or invalid Alias IP configuration for private clusters Using a custom VPC network without specifying a valid subnetwork Specifying a subnetwork that doesn't exist in the chosen network
Is the "Error: Error creating GKE Cluster: BadRequest" error serious?
Yes. This is a high-severity error that usually blocks work until it is fixed, but the steps above resolve it.

Official resources & further reading