{"record":{"id":"57ffbd17b49433dd","repo":"kubernetes/kops","slug":"providerid-q-did-not-match-our-project-q","errorCode":null,"errorMessage":"providerID %q did not match our project %q","messagePattern":"providerID %q did not match our project %q","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/nodeidentity/gce/identify.go","lineNumber":115,"sourceCode":"\tproviderID := node.Spec.ProviderID\n\tif providerID == \"\" {\n\t\treturn nil, fmt.Errorf(\"providerID was not set for node %s\", node.Name)\n\t}\n\tif !strings.HasPrefix(providerID, \"gce://\") {\n\t\treturn nil, fmt.Errorf(\"providerID %q not recognized for node %s\", providerID, node.Name)\n\t}\n\n\ttokens := strings.Split(strings.TrimPrefix(providerID, \"gce://\"), \"/\")\n\tif len(tokens) != 3 {\n\t\treturn nil, fmt.Errorf(\"providerID %q not recognized for node %s\", providerID, node.Name)\n\t}\n\n\tproject := tokens[0]\n\tzone := tokens[1]\n\tinstanceName := tokens[2]\n\n\tif project != i.project {\n\t\treturn nil, fmt.Errorf(\"providerID %q did not match our project %q\", providerID, i.project)\n\t}\n\n\tinstance, err := i.getInstance(zone, instanceName)\n\tif err != nil {\n\t\treturn nil, err\n\t}\n\n\tinstanceStatus := instance.Status\n\tif instanceStatus != \"RUNNING\" {\n\t\treturn nil, fmt.Errorf(\"found instance %q, but status is %q\", instanceName, instanceStatus)\n\t}\n\n\tcapgRole := instance.Labels[LabelKeyCAPIRoleName]\n\n\tvar capiMachine *clusterapi.Machine\n\n\tif i.capiManager != nil && capgRole != \"\" {\n\t\tproviderID := \"gce://\" + project + \"/\" + zone + \"/\" + instanceName","sourceCodeStart":97,"sourceCodeEnd":133,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/pkg/nodeidentity/gce/identify.go#L97-L133","documentation":"The nodeIdentifier is bound to a specific GCE project (i.project). If the providerID's project component differs from the configured project, the identifier refuses to proceed — it assumes the instance is not part of this cluster's project and would not be authorized or meaningful to look up.","triggerScenarios":"Calling IdentifyNode with a node whose providerID is gce://other-project/zone/instance while the nodeIdentifier was constructed with project \"my-project\" (via its GCE credentials / cloud config).","commonSituations":"Shared VPC or multi-project deployments where nodes live in service projects but the controller runs with host-project credentials; copy-pasted node fixtures from another cluster; using default credentials from the wrong project; moved/re-created clusters reusing old node data.","solutions":["Run the node-identity controller with credentials/config for the project that actually hosts the nodes (set the project in cloud config or use credentials of that project's service account).","Verify with `gcloud config get-value project` / the controller's startup config that i.project matches the cluster's node project.","If nodes genuinely belong to another project, this node is out of scope — exclude it or run a separate identifier per project.","Patch stale providerIDs pointing at old projects after cluster migration."],"exampleFix":"// before (controller configured for proj-a, node in proj-b)\nproviderID = \"gce://proj-b/us-central1-a/node-1\"\n// after — configure identifier with the node's project\ni, _ := newNodeIdentifier(ctx, \"proj-b\", ...) // or fix node providerID to \"gce://proj-a/...\" if that's correct","handlingStrategy":"validation","validationCode":"tokens := strings.Split(strings.TrimPrefix(node.Spec.ProviderID, \"gce://\"), \"/\")\nif len(tokens) == 3 && tokens[0] != configuredProject {\n    return fmt.Errorf(\"node %s belongs to project %s, controller configured for %s\", node.Name, tokens[0], configuredProject)\n}","typeGuard":"func providerIDMatchesProject(node *corev1.Node, project string) bool {\n    t := strings.Split(strings.TrimPrefix(node.Spec.ProviderID, \"gce://\"), \"/\")\n    return len(t) == 3 && t[0] == project\n}","tryCatchPattern":"info, err := identifier.IdentifyNode(ctx, node)\nif err != nil && strings.Contains(err.Error(), \"did not match our project\") {\n    // out-of-scope node: skip rather than error\n    return skipNode(node)\n}","preventionTips":["Configure the controller's GCE project to match the cluster's node project.","In shared-VPC setups, run one identifier per service project.","Verify project with `gcloud config get-value project` before deploying.","Patch stale providerIDs after cluster migrations."],"tags":["gce","kubernetes","node-identity","project-mismatch","configuration"],"backgroundTag":"project-mismatch","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T07:17:12.445Z"}