{"record":{"id":"cb648282ba00e23c","repo":"kubernetes/kops","slug":"error-building-token-source-v","errorCode":null,"errorMessage":"error building token source: %v","messagePattern":"error building token source: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"upup/pkg/fi/cloudup/gce/gce_cloud.go","lineNumber":403,"sourceCode":"\t}\n\n\tvar matches []*compute.InstanceTemplate\n\tfor _, t := range ts {\n\t\tif !gcemetadata.MetadataMatchesClusterName(findClusterName, t.Properties.Metadata) {\n\t\t\tcontinue\n\t\t}\n\n\t\tmatches = append(matches, t)\n\t}\n\n\treturn matches, nil\n}\n\n// logTokenInfo returns information about the active credential\nfunc (c *gceCloudImplementation) getTokenInfo(ctx context.Context) (*oauth2.Tokeninfo, error) {\n\ttokenSource, err := google.DefaultTokenSource(ctx, compute.CloudPlatformScope)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"error building token source: %v\", err)\n\t}\n\n\ttoken, err := tokenSource.Token()\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"error getting token: %v\", err)\n\t}\n\n\t// Note: do not log token or any portion of it\n\n\tservice, err := oauth2.NewService(ctx)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"error creating oauth2 service: %v\", err)\n\t}\n\n\ttokenInfo, err := service.Tokeninfo().AccessToken(token.AccessToken).Do()\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"error fetching oauth2 token info: %v\", err)\n\t}","sourceCodeStart":385,"sourceCodeEnd":421,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/upup/pkg/fi/cloudup/gce/gce_cloud.go#L385-L421","documentation":"Wraps google.DefaultTokenSource failure in getTokenInfo, which resolves the active credential's OAuth token info for diagnostic logging during GCE cloud construction. Fires when no Application Default Credentials are available.","triggerScenarios":"Thrown at upup/pkg/fi/cloudup/gce/gce_cloud.go:403 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Configure ADC (gcloud auth application-default login or GOOGLE_APPLICATION_CREDENTIALS)","Check the wrapped error for the credential chain failure"],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T07:17:12.445Z"}