{"record":{"id":"4fae7a862db0fb2f","repo":"kubernetes/kops","slug":"instance-was-in-zone-q-expected-region-q","errorCode":null,"errorMessage":"instance was in zone %q, expected region %q","messagePattern":"instance was in zone %q, expected region %q","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"upup/pkg/fi/cloudup/gce/tpm/gcetpmverifier/tpmverifier.go","lineNumber":138,"sourceCode":"\tif tokenData.Instance == \"\" {\n\t\treturn nil, fmt.Errorf(\"instance is required\")\n\t}\n\n\t// Verify node is in our cluster\n\tif tokenData.GCPProjectID != v.opt.ProjectID {\n\t\treturn nil, fmt.Errorf(\"projectID does not match expected: got %q, want %q\", tokenData.GCPProjectID, v.opt.ProjectID)\n\t}\n\n\tinstance, err := v.computeClient.Instances.Get(tokenData.GCPProjectID, tokenData.Zone, tokenData.Instance).Context(ctx).Do()\n\tif err != nil {\n\t\tif isNotFound(err) {\n\t\t\treturn nil, fmt.Errorf(\"unable to find instance in compute API: %w\", err)\n\t\t}\n\t\treturn nil, fmt.Errorf(\"error fetching instance from compute API: %w\", err)\n\t}\n\n\tif !strings.HasPrefix(lastComponent(instance.Zone), v.opt.Region+\"-\") {\n\t\treturn nil, fmt.Errorf(\"instance was in zone %q, expected region %q\", instance.Zone, v.opt.Region)\n\t}\n\n\tclusterName := \"\"\n\tinstanceGroupName := \"\"\n\tfor _, item := range instance.Metadata.Items {\n\t\tswitch item.Key {\n\t\tcase gce.MetadataKeyInstanceGroupName:\n\t\t\tinstanceGroupName = fi.ValueOf(item.Value)\n\t\tcase gcemetadata.MetadataKeyClusterName:\n\t\t\tclusterName = fi.ValueOf(item.Value)\n\t\t}\n\t}\n\n\tcapgRole := instance.Labels[gce.LabelKeyCAPIRoleName]\n\n\tif clusterName == \"\" {\n\t\treturn nil, fmt.Errorf(\"could not determine cluster for instance %s\", instance.SelfLink)\n\t}","sourceCodeStart":120,"sourceCodeEnd":156,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/upup/pkg/fi/cloudup/gce/tpm/gcetpmverifier/tpmverifier.go#L120-L156","documentation":"After fetching the instance, the verifier requires its zone to fall inside its configured region (zone name must start with v.opt.Region + \"-\"). This keeps the trusted node pool scoped to the cluster's region and rejects instances from elsewhere.","triggerScenarios":"lastComponent(instance.Zone) (e.g. \"us-west1-b\") does not begin with v.opt.Region + \"-\" (e.g. \"us-central1\").","commonSituations":"Nodes provisioned in a different region than the verifier's Region option, cluster expanded cross-region without updating the verifier, multi-region fleets hitting a single verifier, or a stale Region value after migrating the cluster.","solutions":["Update v.opt.Region in the verifier configuration to include the region the instance actually runs in.","Move the node's instance group into the configured region, or deploy a verifier per region.","Ensure the cluster's GCE provider settings (regions) and verifier options were updated together after any region migration."],"exampleFix":"// before\nv.opt.Region = \"us-central1\"\n// after (nodes actually in us-west1)\nv.opt.Region = \"us-west1\"","handlingStrategy":"validation","validationCode":"if !strings.HasPrefix(lastComponent(instance.Zone), expectedRegion+\"-\") {\n\treturn fmt.Errorf(\"instance zone %s outside expected region %s\", instance.Zone, expectedRegion)\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Keep verifier Region option in sync with cluster region","Deploy one verifier per region for multi-region clusters","Update region config when migrating clusters"],"tags":["gcp","configuration","authorization","region"],"backgroundTag":"region-mismatch","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T07:17:12.445Z"}