{"record":{"id":"a14c6121c85b92cb","repo":"kubernetes/kops","slug":"error-finding-machine-with-providerid-q-w","errorCode":null,"errorMessage":"error finding Machine with providerID %q: %w","messagePattern":"error finding Machine with providerID %q: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/nodeidentity/gce/identify.go","lineNumber":137,"sourceCode":"\tif err != nil {\n\t\treturn nil, err\n\t}\n\n\tinstanceStatus := instance.Status\n\tif instanceStatus != \"RUNNING\" {\n\t\treturn nil, fmt.Errorf(\"found instance %q, but status is %q\", instanceName, instanceStatus)\n\t}\n\n\tcapgRole := instance.Labels[LabelKeyCAPIRoleName]\n\n\tvar capiMachine *clusterapi.Machine\n\n\tif i.capiManager != nil && capgRole != \"\" {\n\t\tproviderID := \"gce://\" + project + \"/\" + zone + \"/\" + instanceName\n\n\t\tm, err := i.capiManager.FindMachineByProviderID(ctx, providerID)\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"error finding Machine with providerID %q: %w\", providerID, err)\n\t\t}\n\t\tcapiMachine = m\n\t}\n\n\tvar igName string\n\tif capiMachine == nil {\n\t\t// The metadata itself is potentially mutable from the instance\n\t\t// We instead look at the MIG configuration\n\t\tcreatedBy := getMetadataValue(instance.Metadata, \"created-by\")\n\t\tif createdBy == \"\" {\n\t\t\treturn nil, fmt.Errorf(\"cannot find owner for instance %s\", instance.Name)\n\t\t}\n\n\t\t// We need to double-check the MIG configuration, in case created-by was changed\n\t\tmigName := lastComponent(createdBy)\n\n\t\tmig, err := i.getMIG(zone, migName)\n\t\tif err != nil {","sourceCodeStart":119,"sourceCodeEnd":155,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/pkg/nodeidentity/gce/identify.go#L119-L155","documentation":"When the instance carries the CAPI (Cluster API) role label, IdentifyNode asks the capiManager to find the matching cluster-api Machine object by providerID, wrapping any underlying error (K8s client failure, etc.) with this message. It indicates the Machine lookup itself failed, not merely that no Machine was found.","triggerScenarios":"Instance has label LabelKeyCAPIRoleName set and i.capiManager != nil, but FindMachineByProviderID returns an error — e.g. the Machine informer/client cannot reach the API server, RBAC denies list/get on machine.cluster.x-k8s.io, or the underlying providerID index lookup errors.","commonSituations":"ClusterAPI management cluster unreachable or creds expired; missing RBAC (ClusterRole) for the node-identity controller to read Machines; CAPG controller not installed so the Machine CRD/client fails; network partition between controller and management apiserver.","solutions":["Check connectivity/RBAC to the cluster-api management cluster: verify the controller's ServiceAccount can get/list machine.cluster.x-k8s.io resources.","Verify the capiManager was initialized with the correct management cluster kubeconfig.","Inspect the wrapped inner error (%w) in logs — it names the actual client/CRD failure.","If the cluster does not use CAPG, ensure instances are not labeled with the CAPI role label, or don't configure a capiManager."],"exampleFix":"// before\nm, err := i.capiManager.FindMachineByProviderID(ctx, providerID)\nif err != nil { return nil, fmt.Errorf(\"error finding Machine with providerID %q: %w\", providerID, err) }\n// after — only attempt lookup when manager healthy and label present\nif i.capiManager != nil && capgRole != \"\" && i.capiManager.Healthy(ctx) {\n    m, err := i.capiManager.FindMachineByProviderID(ctx, providerID)\n    if err != nil { return nil, fmt.Errorf(\"error finding Machine with providerID %q: %w\", providerID, err) }\n    capiMachine = m\n}","handlingStrategy":"try-catch","validationCode":"if i.capiManager != nil && instance.Labels[LabelKeyCAPIRoleName] != \"\" {\n    // ensure management cluster reachable first\n    if err := i.capiManager.Ping(ctx); err != nil {\n        return fmt.Errorf(\"management cluster unreachable, skipping Machine lookup: %w\", err)\n    }\n}","typeGuard":"func canLookupMachine(i *nodeIdentifier, instance *compute.Instance) bool {\n    return i != nil && i.capiManager != nil && instance.Labels[LabelKeyCAPIRoleName] != \"\"\n}","tryCatchPattern":"info, err := identifier.IdentifyNode(ctx, node)\nvar apiErr *googleapi.Error\nif err != nil {\n    if errors.Is(err, context.DeadlineExceeded) || errors.As(err, &apiErr) {\n        // fall back to legacy MIG path or requeue\n        return fallbackIdentify(node)\n    }\n    return err\n}","preventionTips":["Grant RBAC for machine.cluster.x-k8s.io get/list to the controller's ServiceAccount.","Monitor management-cluster connectivity; health-check capiManager before lookups.","Keep CAPG controllers installed and CRDs up to date.","Always log the wrapped inner error to distinguish RBAC vs network vs CRD issues."],"tags":["gce","kubernetes","cluster-api","machine-lookup","rbac"],"backgroundTag":"machine-lookup-failed","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T12:17:11.808Z"}