{"record":{"id":"bfb6fca6f2ab3814","repo":"kubernetes/kops","slug":"error-finding-machine-with-providerid-q-w-bfb6fc","errorCode":null,"errorMessage":"error finding Machine with providerID %q: %w","messagePattern":"error finding Machine with providerID %q: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"upup/pkg/fi/cloudup/gce/tpm/gcetpmverifier/tpmverifier.go","lineNumber":169,"sourceCode":"\n\tcapgRole := instance.Labels[gce.LabelKeyCAPIRoleName]\n\n\tif clusterName == \"\" {\n\t\treturn nil, fmt.Errorf(\"could not determine cluster for instance %s\", instance.SelfLink)\n\t}\n\n\tif clusterName != v.opt.ClusterName {\n\t\treturn nil, fmt.Errorf(\"clusterName does not match expected: got %q, want %q\", clusterName, v.opt.ClusterName)\n\t}\n\n\tvar capiMachine *clusterapi.Machine\n\n\tif v.capiManager != nil && capgRole != \"\" {\n\t\tproviderID := \"gce://\" + tokenData.GCPProjectID + \"/\" + tokenData.Zone + \"/\" + tokenData.Instance\n\n\t\tm, err := v.capiManager.FindMachineByProviderID(ctx, providerID)\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"error finding Machine with providerID %q: %w\", providerID, err)\n\t\t}\n\t\tcapiMachine = m\n\t}\n\n\t// Check if this is a CAPG managed instance\n\tif instanceGroupName == \"\" && capiMachine == nil {\n\t\treturn nil, fmt.Errorf(\"could not determine ownership for instance %s\", instance.SelfLink)\n\t}\n\n\t// Verify the token has a valid GCE TPM signature.\n\t{\n\t\t// Note - we might be able to avoid this call by including the attestation certificate (signed by GCE) in the claim.\n\t\ttpmSigningKey, err := v.getTPMSigningKey(ctx, &tokenData)\n\t\tif err != nil {\n\t\t\treturn nil, err\n\t\t}\n\n\t\tif !verifySignature(tpmSigningKey, token.Data, token.Signature) {","sourceCodeStart":151,"sourceCodeEnd":187,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/upup/pkg/fi/cloudup/gce/tpm/gcetpmverifier/tpmverifier.go#L151-L187","documentation":"When the instance carries the CAPG role label, VerifyToken looks up the corresponding Cluster API Machine by providerID (gce://project/zone/instance). This error wraps any failure from FindMachineByProviderID, typically a Kubernetes API error reaching the management cluster or an internal lookup failure.","triggerScenarios":"capiManager is non-nil and the instance has the CAPG role label, but FindMachineByProviderID returns an error: management cluster API unreachable, RBAC denied listing Machines, or the providerID index lookup fails.","commonSituations":"CAPG management cluster API server down or unreachable from the verifier; missing RBAC permissions for Machines; providerID format drift between CAPG versions (e.g. zone vs region mismatch in the gce:// URI).","solutions":["Check connectivity and RBAC from the verifier to the CAPI management cluster's API server","Verify a Machine object exists whose spec.providerID exactly equals gce://<project>/<zone>/<instance>","Confirm CAPG version produces providerIDs in the same gce://project/zone/name format","Retry if the API server error was transient"],"exampleFix":null,"handlingStrategy":"retry","validationCode":"// check a Machine exists for this providerID before verification\npid := \"gce://\" + proj + \"/\" + zone + \"/\" + name\nm, err := capiManager.FindMachineByProviderID(ctx, pid)\nif err != nil { return fmt.Errorf(\"CAPI lookup not possible: %w\", err) }\nif m == nil { return fmt.Errorf(\"no Machine with providerID %s\", pid) }","typeGuard":null,"tryCatchPattern":"m, err := capiManager.FindMachineByProviderID(ctx, providerID)\nif err != nil {\n    if isTransient(err) { time.Sleep(backoff); retry() }\n    return fmt.Errorf(\"error finding Machine with providerID %q: %w\", providerID, err)\n}","preventionTips":["Ensure the verifier has working kubeconfig/RBAC to list Machines in the management cluster","Keep CAPG and kops versions aligned on providerID format","Monitor management cluster API health from the verifier","Apply retry with backoff for transient API server errors"],"tags":["gce","capi","capg","providerid","kubernetes"],"backgroundTag":"machine-providerid-not-found","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T07:17:12.445Z"}