{"record":{"id":"2bab65f25e933115","repo":"kubernetes/kops","slug":"could-not-determine-ownership-for-instance-s","errorCode":null,"errorMessage":"could not determine ownership for instance %s","messagePattern":"could not determine ownership for instance (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"critical","filePath":"upup/pkg/fi/cloudup/gce/tpm/gcetpmverifier/tpmverifier.go","lineNumber":176,"sourceCode":"\tif clusterName != v.opt.ClusterName {\n\t\treturn nil, fmt.Errorf(\"clusterName does not match expected: got %q, want %q\", clusterName, v.opt.ClusterName)\n\t}\n\n\tvar capiMachine *clusterapi.Machine\n\n\tif v.capiManager != nil && capgRole != \"\" {\n\t\tproviderID := \"gce://\" + tokenData.GCPProjectID + \"/\" + tokenData.Zone + \"/\" + tokenData.Instance\n\n\t\tm, err := v.capiManager.FindMachineByProviderID(ctx, providerID)\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"error finding Machine with providerID %q: %w\", providerID, err)\n\t\t}\n\t\tcapiMachine = m\n\t}\n\n\t// Check if this is a CAPG managed instance\n\tif instanceGroupName == \"\" && capiMachine == nil {\n\t\treturn nil, fmt.Errorf(\"could not determine ownership for instance %s\", instance.SelfLink)\n\t}\n\n\t// Verify the token has a valid GCE TPM signature.\n\t{\n\t\t// Note - we might be able to avoid this call by including the attestation certificate (signed by GCE) in the claim.\n\t\ttpmSigningKey, err := v.getTPMSigningKey(ctx, &tokenData)\n\t\tif err != nil {\n\t\t\treturn nil, err\n\t\t}\n\n\t\tif !verifySignature(tpmSigningKey, token.Data, token.Signature) {\n\t\t\treturn nil, fmt.Errorf(\"failed to verify claim signature for node: %w\", err)\n\t\t}\n\t}\n\n\tsans, err := GetInstanceCertificateAlternateNames(instance)\n\tif err != nil {\n\t\treturn nil, err","sourceCodeStart":158,"sourceCodeEnd":194,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/upup/pkg/fi/cloudup/gce/tpm/gcetpmverifier/tpmverifier.go#L158-L194","documentation":"VerifyToken cannot attribute the instance to this cluster: it has neither the kops instance-group metadata item (a kops-managed instance) nor a matching CAPI Machine (a CAPG-managed instance). The verifier refuses to issue credentials for instances it cannot prove ownership of.","triggerScenarios":"Instance has an empty instance-group-name metadata item AND either capiManager is nil / the CAPG role label is absent, or FindMachineByProviderID returned no Machine — i.e. an instance whose ownership path is unresolvable.","commonSituations":"A hand-created or imported VM trying to join the cluster; instance metadata stripped (e.g. copied disk or custom image without kops metadata); a CAPG machine deleted from the management cluster while the VM persists; non-CAPG nodes when capiManager is configured to require CAPG.","solutions":["Ensure the instance was created by kops/CAPG with the instance-group-name metadata stamped","If CAPG-managed, verify the instance has the CAPG role label and a matching Machine with the correct providerID","Delete unauthorized instances — they should not join the cluster","If a rebuilt instance lost metadata, recreate it via kops rolling-update"],"exampleFix":null,"handlingStrategy":"validation","validationCode":"inst, _ := computeClient.Instances.Get(proj, zone, name).Do()\nhasIG := false\nfor _, it := range inst.Metadata.Items {\n    if it.Key == \"instance-group-name\" && fi.ValueOf(it.Value) != \"\" { hasIG = true }\n}\nif !hasIG && inst.Labels[\"capg-role\"] == \"\" {\n    return fmt.Errorf(\"instance %s has no kops or CAPG ownership markers\", name)\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Only add nodes to the cluster via kops or CAPG; block direct VM joins","Verify instance metadata is intact after any disk/image migration","Keep CAPG Machine objects in sync with running VMs","Treat ownership errors as security events and audit the instance"],"tags":["gce","tpm","ownership","bootstrap","security"],"backgroundTag":"instance-ownership-unknown","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T07:17:12.445Z"}