{"record":{"id":"2df9641bd5f681a2","repo":"kubernetes/kops","slug":"missing-instance-id-s","errorCode":null,"errorMessage":"missing instance id: %s","messagePattern":"missing instance id: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/bootstrap/awsbootstrap/verifier.go","lineNumber":302,"sourceCode":"\t\tif resource[1] == role {\n\t\t\tfound = true\n\t\t\tbreak\n\t\t}\n\t}\n\tif !found {\n\t\treturn nil, fmt.Errorf(\"arn %q does not contain acceptable node role\", arn)\n\t}\n\n\tinstanceID := resource[2]\n\tinstances, err := a.ec2.DescribeInstances(ctx, &ec2.DescribeInstancesInput{\n\t\tInstanceIds: []string{instanceID},\n\t})\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"describing instance for arn %q\", arn)\n\t}\n\n\tif len(instances.Reservations) <= 0 || len(instances.Reservations[0].Instances) <= 0 {\n\t\treturn nil, fmt.Errorf(\"missing instance id: %s\", instanceID)\n\t}\n\tif len(instances.Reservations[0].Instances) > 1 {\n\t\treturn nil, fmt.Errorf(\"found multiple instances with instance id: %s\", instanceID)\n\t}\n\n\tinstance := instances.Reservations[0].Instances[0]\n\n\taddrs, err := GetInstanceCertificateNames(instances)\n\tif err != nil {\n\t\treturn nil, err\n\t}\n\n\tvar challengeEndpoints []string\n\tfor _, nic := range instance.NetworkInterfaces {\n\t\tif ip := aws.ToString(nic.PrivateIpAddress); ip != \"\" {\n\t\t\tchallengeEndpoints = append(challengeEndpoints, net.JoinHostPort(ip, strconv.Itoa(wellknownports.NodeupChallenge)))\n\t\t}\n\t\tfor _, a := range nic.PrivateIpAddresses {","sourceCodeStart":284,"sourceCodeEnd":320,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/pkg/bootstrap/awsbootstrap/verifier.go#L284-L320","documentation":"The EC2 DescribeInstances call succeeded but returned no reservations or no instances, meaning the instance ID taken from the assumed-role session name does not correspond to a live EC2 instance visible to this account/region. kOps requires an exact single-instance match to derive the node's certificate names and challenge endpoints.","triggerScenarios":"verifyCallerIdentity queries DescribeInstances with the ID parsed from resource[2] and gets zero results — the session name was not a real instance ID, the instance was terminated, or the instance lives in another account/region than the one the verifier queries.","commonSituations":"AssumeRole called with RoleSessionName that isn't an instance ID (e.g. \"build-session\"); instance terminated between credential minting and verification; multi-region or cross-account confusion (instance in another region's EC2 endpoint); stale credentials reused after instance replacement in an autoscaling group.","solutions":["Confirm the instance ID in the ARN session segment exists: aws ec2 describe-instances --instance-ids i-xxx in the same region/account as the API server.","Ensure nodeup uses the IMDS-provided credentials so the session name is the actual instance ID, not an arbitrary string.","Rebootstrap the node with fresh credentials if the original instance was terminated and replaced.","Verify the API server is operating in the same region as the cluster's instances (KOPS_REGION / cluster spec region)."],"exampleFix":"// before: sts assume-role with non-instance session name\n--role-session-name deploy-test\n// after\n--role-session-name $(INSTANCE_ID)  // from IMDS, matching a live EC2 instance","handlingStrategy":"validation","validationCode":"out, err := ec2Client.DescribeInstances(ctx, &ec2.DescribeInstancesInput{InstanceIds: []string{instanceID}})\nif err != nil || len(out.Reservations) == 0 || len(out.Reservations[0].Instances) == 0 {\n    return fmt.Errorf(\"instance %s not found in region %s/account %s; confirm it exists and is running\", instanceID, region, account)\n}","typeGuard":"func instanceExists(reservations []types.Reservation) bool {\n\tfor _, r := range reservations {\n\t\tif len(r.Instances) > 0 {\n\t\t\treturn true\n\t\t}\n\t}\n\treturn false\n}","tryCatchPattern":"if err == nil && (len(instances.Reservations) == 0 || len(instances.Reservations[0].Instances) == 0) {\n\treturn nil, fmt.Errorf(\"missing instance id: %s (check region %s and that the instance is running)\", instanceID, region)\n}","preventionTips":["Confirm `aws ec2 describe-instances --instance-ids <id>` succeeds in the same region before bootstrapping.","Use IMDS credentials so the session name is always the real instance ID.","Re-request bootstrap credentials after an instance is replaced by the autoscaling group.","Ensure the API server's region matches the cluster region (KOPS_REGION / cluster spec)."],"tags":["aws","ec2","bootstrap","instance-not-found"],"backgroundTag":"instance-not-found","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T07:17:12.445Z"}