{"record":{"id":"6a70ade923f037c3","repo":"kubernetes/kops","slug":"error-fetching-instance-from-compute-api-w","errorCode":null,"errorMessage":"error fetching instance from compute API: %w","messagePattern":"error fetching instance from compute API: %w","errorType":"error_code","errorClass":null,"httpStatus":null,"severity":"error","filePath":"upup/pkg/fi/cloudup/gce/tpm/gcetpmverifier/tpmverifier.go","lineNumber":134,"sourceCode":"\t}\n\tif tokenData.Zone == \"\" {\n\t\treturn nil, fmt.Errorf(\"zone is required\")\n\t}\n\tif tokenData.Instance == \"\" {\n\t\treturn nil, fmt.Errorf(\"instance is required\")\n\t}\n\n\t// Verify node is in our cluster\n\tif tokenData.GCPProjectID != v.opt.ProjectID {\n\t\treturn nil, fmt.Errorf(\"projectID does not match expected: got %q, want %q\", tokenData.GCPProjectID, v.opt.ProjectID)\n\t}\n\n\tinstance, err := v.computeClient.Instances.Get(tokenData.GCPProjectID, tokenData.Zone, tokenData.Instance).Context(ctx).Do()\n\tif err != nil {\n\t\tif isNotFound(err) {\n\t\t\treturn nil, fmt.Errorf(\"unable to find instance in compute API: %w\", err)\n\t\t}\n\t\treturn nil, fmt.Errorf(\"error fetching instance from compute API: %w\", err)\n\t}\n\n\tif !strings.HasPrefix(lastComponent(instance.Zone), v.opt.Region+\"-\") {\n\t\treturn nil, fmt.Errorf(\"instance was in zone %q, expected region %q\", instance.Zone, v.opt.Region)\n\t}\n\n\tclusterName := \"\"\n\tinstanceGroupName := \"\"\n\tfor _, item := range instance.Metadata.Items {\n\t\tswitch item.Key {\n\t\tcase gce.MetadataKeyInstanceGroupName:\n\t\t\tinstanceGroupName = fi.ValueOf(item.Value)\n\t\tcase gcemetadata.MetadataKeyClusterName:\n\t\t\tclusterName = fi.ValueOf(item.Value)\n\t\t}\n\t}\n\n\tcapgRole := instance.Labels[gce.LabelKeyCAPIRoleName]","sourceCodeStart":116,"sourceCodeEnd":152,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/upup/pkg/fi/cloudup/gce/tpm/gcetpmverifier/tpmverifier.go#L116-L152","documentation":"The Compute API call Instances.Get failed with an error other than 404 (e.g. quota, permission, throttling, or API outage). The verifier cannot confirm the instance's existence or metadata, so token verification fails.","triggerScenarios":"computeClient.Instances.Get(...).Do() returns a non-NotFound error — 403 for missing compute.instances.get permission, 429 rate limiting, 5xx from GCE, or network failure from the verifier.","commonSituations":"Verifier's service account lacks Compute Viewer role, GCE API rate limits exceeded during mass node join, regional API outages, or the Compute Engine API disabled on the project.","solutions":["Inspect the wrapped error (%w) for the underlying googleapi status code and message.","Grant the verifier's service account roles/compute.viewer (or compute.instances.get) on the project.","Enable the Compute Engine API for the project and retry; add backoff/retry for 429/5xx errors.","Check GCP status for regional Compute API incidents."],"exampleFix":"// before: no compute role\n// verifier SA: roles/none\n// after\ngcloud projects add-iam-policy-binding PROJECT --member serviceAccount:VERIFIER_SA --role roles/compute.viewer","handlingStrategy":"retry","validationCode":"// pre-check IAM: verifier SA has compute.instances.get on the project\n// and Compute Engine API is enabled","typeGuard":null,"tryCatchPattern":"var gerr *googleapi.Error\nif errors.As(err, &gerr) {\n\tswitch {\n\tcase gerr.Code == 429 || gerr.Code >= 500:\n\t\t// exponential backoff and retry\n\tcase gerr.Code == 403:\n\t\t// surface IAM misconfiguration to operator\n\t}\n}","preventionTips":["Grant roles/compute.viewer to the verifier service account","Enable Compute Engine API on the project","Implement backoff for 429/5xx on Compute API calls"],"tags":["gcp","compute-api","permissions","network"],"backgroundTag":"cloud-api-request-failed","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T07:17:12.445Z"}