{"record":{"id":"c0f46971cd03b8d2","repo":"kubernetes/kops","slug":"did-not-find-owner-for-node-q","errorCode":null,"errorMessage":"did not find owner for node %q","messagePattern":"did not find owner for node %q","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"cmd/kops-controller/pkg/server/node_config.go","lineNumber":46,"sourceCode":"\t\"k8s.io/kops/pkg/apis/nodeup\"\n\t\"k8s.io/kops/pkg/bootstrap\"\n\t\"k8s.io/kops/pkg/commands\"\n\t\"k8s.io/kops/pkg/nodeidentity/clusterapi\"\n)\n\nfunc (s *Server) getNodeConfig(ctx context.Context, req *nodeup.BootstrapRequest, identity *bootstrap.VerifyResult) (*nodeup.NodeConfig, error) {\n\tlog := klog.FromContext(ctx)\n\n\tif identity == nil {\n\t\treturn nil, fmt.Errorf(\"node identity is required\")\n\t}\n\n\tlog.Info(\"getting node config\", \"req\", req, \"identity\", identity)\n\n\tinstanceGroupName := identity.InstanceGroupName\n\tif instanceGroupName == \"\" {\n\t\tif identity.CAPIMachine == nil {\n\t\t\treturn nil, fmt.Errorf(\"did not find owner for node %q\", identity.NodeName)\n\t\t}\n\t\t// CAPI path: the InstanceGroup is synthesized from the Machine and\n\t\t// the name never reaches the configBase path, so we don't validate it.\n\t} else if errs := kopsvalidation.ValidateInstanceGroupName(instanceGroupName, field.NewPath(\"instanceGroupName\")); len(errs) > 0 {\n\t\treturn nil, fmt.Errorf(\"invalid InstanceGroup name: %v\", errs.ToAggregate())\n\t}\n\n\tvar nodeConfig *nodeup.NodeConfig\n\n\tconfigBuilder := &commands.ConfigBuilder{\n\t\tClientset:   s.clientset,\n\t\tClusterName: s.opt.ClusterName,\n\t}\n\n\tif identity.CAPIMachine != nil && instanceGroupName == \"\" {\n\t\t// We have a CAPI Machine (but no instance group)\n\t\tinstanceGroup, err := s.buildInstanceGroupFromCAPI(ctx, identity.CAPIMachine)\n\t\tif err != nil {","sourceCodeStart":28,"sourceCodeEnd":64,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/cmd/kops-controller/pkg/server/node_config.go#L28-L64","documentation":"getNodeConfig requires knowing which InstanceGroup owns the node before it can build a NodeConfig. If identity.InstanceGroupName is empty and the verified identity carries no CAPI Machine object, the server has no owner information for the node and rejects the request with the node's name. The InstanceGroup name is essential because the nodeup config is stored per InstanceGroup under configBase.","triggerScenarios":"A node successfully passes identity verification (identity is non-nil) but identity.InstanceGroupName == \"\" and identity.CAPIMachine == nil. This means the verification method used could not map the node's cloud identity to either a kops InstanceGroup or a Cluster API Machine.","commonSituations":"Running kops-controller without the CAPI integration while nodes are actually CAPI Machines; the cloud provider's instanceID/name lookup returned nothing (e.g. instance was deleted, wrong region/account, IAM permissions missing for the metadata API); ASG/InstanceGroup tags missing so ownership cannot be resolved.","solutions":["Verify the node exists in the cloud provider account/region kops-controller is configured for and that its IAM role permits the metadata lookups used during verification","If using Cluster API, enable/deploy the CAPI integration so identity.CAPIMachine is populated (machine-controller must be able to list Machines)","Confirm the InstanceGroup still exists and the node's tags/labels map back to it; recreate the node if it was orphaned","Check kops-controller logs for the verification step to see which lookup failed to resolve ownership"],"exampleFix":null,"handlingStrategy":"validation","validationCode":"ig, err := resolveInstanceGroupForNode(node)\nif err != nil || ig == \"\" {\n\treturn fmt.Errorf(\"cannot resolve InstanceGroup owner for node %s\", node)\n}","typeGuard":null,"tryCatchPattern":"if err != nil && strings.Contains(err.Error(), \"did not find owner for node\") {\n\t// node has no InstanceGroup/CAPI Machine mapping; recreate or re-tag the node\n}","preventionTips":["Keep InstanceGroup tags on cloud instances intact so ownership resolves","Deploy the CAPI integration (machine-controller) when running Cluster API machines","Confirm kops-controller's cloud credentials can read instance metadata","Avoid deleting InstanceGroups while their nodes are still running"],"tags":["kubernetes","kops","bootstrap","instancegroup","capi"],"backgroundTag":"instancegroup-owner-not-found","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T07:17:12.445Z"}