{"record":{"id":"3da0c828fe6f3098","repo":"kubernetes/kops","slug":"error-building-compute-api-client-v","errorCode":null,"errorMessage":"error building compute API client: %v","messagePattern":"error building compute API client: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/nodeidentity/gce/identify.go","lineNumber":66,"sourceCode":"\tcomputeService *compute.Service\n\n\t// project is our GCE project; we require that instances be in this project\n\tproject string\n\n\t// clusterName is the metadata.name of our cluster\n\tclusterName string\n\n\t// capiManager contains our CAPI support, if CAPI support is enabled\n\tcapiManager *capimanager.Manager\n}\n\n// New creates and returns a nodeidentity.Identifier for Nodes running on GCE\nfunc New(clusterName string, capiManager *capimanager.Manager) (nodeidentity.Identifier, error) {\n\tctx := context.Background()\n\n\tcomputeService, err := compute.NewService(ctx)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"error building compute API client: %v\", err)\n\t}\n\n\t// Project ID\n\tproject := os.Getenv(\"GCP_PROJECT\")\n\tif project != \"\" {\n\t\tklog.Infof(\"using project=%q from GCP_PROJECT env var\", project)\n\t} else {\n\t\tproject, err = metadata.ProjectID()\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"error reading project from GCE: %v\", err)\n\t\t}\n\t\tproject = strings.TrimSpace(project)\n\t\tif project == \"\" {\n\t\t\treturn nil, fmt.Errorf(\"project metadata was empty\")\n\t\t}\n\t\tklog.Infof(\"Found project=%q\", project)\n\t}\n","sourceCodeStart":48,"sourceCodeEnd":84,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/pkg/nodeidentity/gce/identify.go#L48-L84","documentation":"New() builds the GCE node identifier and first constructs a compute.Service via compute.NewService, which relies on Application Default Credentials. If client construction fails (bad credentials, missing google API client config, transport errors), this error wraps the cause.","triggerScenarios":"compute.NewService(ctx) fails: no Application Default Credentials available on the controller host/pod, malformed GOOGLE_APPLICATION_CREDENTIALS, or failure initializing the compute API client.","commonSituations":"Controller not running on GCE and no service-account key provided; GOOGLE_APPLICATION_CREDENTIALS pointing to a missing/invalid JSON key; workload identity/firmware misconfiguration on the GKE/kops-on-GCE controller; missing compute API scopes on the instance.","solutions":["Set GOOGLE_APPLICATION_CREDENTIALS to a valid service-account JSON key with compute scope, or configure workload identity","Ensure the instance/pod has the compute.readonly or compute scope and that the Compute Engine API is enabled in the project","Verify the credentials JSON parses and the key is not revoked (gcloud auth application-default print-access-token)","Confirm the google.golang.org/api compute package is correctly initialized in the deployment (no stripped default client)"],"exampleFix":"// before\n# no credentials configured\n// after\nexport GOOGLE_APPLICATION_CREDENTIALS=/etc/gcp/service-account.json","handlingStrategy":"validation","validationCode":"creds := os.Getenv(\"GOOGLE_APPLICATION_CREDENTIALS\")\nif creds == \"\" {\n    if _, err := metadata.ProjectID(); err != nil {\n        return errors.New(\"no GCP credentials or metadata server available\")\n    }\n}\nif _, err := tokenSourceToken(ctx); err != nil {\n    return fmt.Errorf(\"GCP credentials invalid: %w\", err)\n}","typeGuard":null,"tryCatchPattern":"ident, err := nodeidentitygce.New(clusterName, capiManager)\nif err != nil {\n    if strings.Contains(err.Error(), \"error building compute API client\") {\n        // fix GOOGLE_APPLICATION_CREDENTIALS or instance scopes, then restart\n    }\n}","preventionTips":["Mount a valid service-account key or configure workload identity on the controller","Enable the Compute Engine API and grant compute scopes on the instance","Validate credentials at deploy time (try fetching an access token)","Keep the google.golang.org/api compute client wired to a usable token source"],"tags":["gce","credentials","client-init","gcp"],"backgroundTag":"default-credentials-unavailable","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T07:17:12.445Z"}