{"record":{"id":"14e78dbd47e50b96","repo":"kubernetes/kops","slug":"error-building-compute-api-client-w","errorCode":null,"errorMessage":"error building compute API client: %w","messagePattern":"error building compute API client: %w","errorType":"error_code","errorClass":null,"httpStatus":null,"severity":"critical","filePath":"upup/pkg/fi/cloudup/gce/tpm/gcetpmverifier/tpmverifier.go","lineNumber":62,"sourceCode":"\t\"k8s.io/kops/upup/pkg/fi/cloudup/gce/gcemetadata\"\n\tgcetpm \"k8s.io/kops/upup/pkg/fi/cloudup/gce/tpm\"\n)\n\ntype tpmVerifier struct {\n\topt gcetpm.TPMVerifierOptions\n\n\tcomputeClient *compute.Service\n\n\tcapiManager *capimanager.Manager\n}\n\n// NewTPMVerifier constructs a new TPM verifier for GCE.\nfunc NewTPMVerifier(opt *gcetpm.TPMVerifierOptions, capiManager *capimanager.Manager) (bootstrap.Verifier, error) {\n\tctx := context.Background()\n\n\tcomputeClient, err := compute.NewService(ctx)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"error building compute API client: %w\", err)\n\t}\n\n\treturn &tpmVerifier{\n\t\topt:           *opt,\n\t\tcomputeClient: computeClient,\n\t\tcapiManager:   capiManager,\n\t}, nil\n}\n\nvar _ bootstrap.Verifier = (*tpmVerifier)(nil)\n\nfunc (v *tpmVerifier) VerifyToken(ctx context.Context, rawRequest *http.Request, authToken string, body []byte) (*bootstrap.VerifyResult, error) {\n\t// Reminder: we shouldn't trust any data we get from the client until we've checked the signature (and even then...)\n\t// Thankfully the GCE SDK does seem to escape the parameters correctly, for example.\n\n\tif !strings.HasPrefix(authToken, gcetpm.GCETPMAuthenticationTokenPrefix) {\n\t\treturn nil, bootstrap.ErrNotThisVerifier\n\t}","sourceCodeStart":44,"sourceCodeEnd":80,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/upup/pkg/fi/cloudup/gce/tpm/gcetpmverifier/tpmverifier.go#L44-L80","documentation":"NewTPMVerifier builds a Google Compute Engine API client (compute.NewService) that it later uses to fetch VM state for verification. If constructing the compute service fails (credentials missing/invalid, transport error), the verifier cannot be constructed and this error is returned to main.","triggerScenarios":"compute.NewService(ctx) fails at verifier startup: no Application Default Credentials, unreadable GOOGLE_APPLICATION_CREDENTIALS, missing required scopes, or failure building the http client (network/proxy errors).","commonSituations":"Node/server pod missing GCP service account or workload identity binding; metadata server unreachable (not running on GCE); GOOGLE_APPLICATION_CREDENTIALS pointing to a deleted/invalid key file; missing compute scopes on the instance.","solutions":["Verify credentials exist and are valid: gcloud auth application-default login or check GOOGLE_APPLICATION_CREDENTIALS","Ensure the instance/pod has compute.readonly (or compute) scope or workload identity with compute.viewer","Confirm the metadata server is reachable (curl -H 'Metadata-Flavor: Google' http://metadata.google.internal)","Check network/proxy settings that could block the compute API endpoint","Grant the service account the required compute API permissions and enable the Compute Engine API on the project"],"exampleFix":"// before\ncomputeClient, err := compute.NewService(ctx)\n// after\nimport \"google.golang.org/api/option\"\ncomputeClient, err := compute.NewService(ctx, option.WithCredentialsFile(\"/etc/gcp/sa.json\"))","handlingStrategy":"try-catch","validationCode":"// before constructing the verifier\ncreds, err := google.FindDefaultCredentials(ctx, compute.ComputeReadonlyScope)\nif err != nil {\n    return fmt.Errorf(\"no GCP credentials: %w\", err)\n}","typeGuard":null,"tryCatchPattern":"verifier, err := gcetpmverifier.NewTPMVerifier(opt, capiManager)\nif err != nil {\n    if strings.Contains(err.Error(), \"compute API client\") {\n        return fmt.Errorf(\"check GCP credentials/scopes for the verifier: %w\", err)\n    }\n    return err\n}","preventionTips":["Attach compute.readonly scope or workload identity to the verifier's instance/pod","Keep GOOGLE_APPLICATION_CREDENTIALS valid and rotate keys","Confirm metadata server reachability at startup","Enable the Compute Engine API in the project"],"tags":["gcp","gce","api-client","credentials"],"backgroundTag":"missing-gcp-credentials","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T07:17:12.445Z"}