{"record":{"id":"cd0cbf68edfa1ab7","repo":"kubernetes/kops","slug":"instance-is-required","errorCode":null,"errorMessage":"instance is required","messagePattern":"instance is required","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"upup/pkg/fi/cloudup/gce/tpm/gcetpmverifier/tpmverifier.go","lineNumber":121,"sourceCode":"\tif timeSkew > float64(v.opt.MaxTimeSkew) {\n\t\treturn nil, fmt.Errorf(\"incorrect Timestamp %v\", tokenData.Timestamp)\n\t}\n\n\t// Verify the token has signed the body content.\n\trequestHash := sha256.Sum256(body)\n\tif !bytes.Equal(requestHash[:], tokenData.RequestHash) {\n\t\treturn nil, fmt.Errorf(\"incorrect RequestHash\")\n\t}\n\n\t// Some basic validation to avoid requesting invalid instances.\n\tif tokenData.GCPProjectID == \"\" {\n\t\treturn nil, fmt.Errorf(\"gcpProjectID is required\")\n\t}\n\tif tokenData.Zone == \"\" {\n\t\treturn nil, fmt.Errorf(\"zone is required\")\n\t}\n\tif tokenData.Instance == \"\" {\n\t\treturn nil, fmt.Errorf(\"instance is required\")\n\t}\n\n\t// Verify node is in our cluster\n\tif tokenData.GCPProjectID != v.opt.ProjectID {\n\t\treturn nil, fmt.Errorf(\"projectID does not match expected: got %q, want %q\", tokenData.GCPProjectID, v.opt.ProjectID)\n\t}\n\n\tinstance, err := v.computeClient.Instances.Get(tokenData.GCPProjectID, tokenData.Zone, tokenData.Instance).Context(ctx).Do()\n\tif err != nil {\n\t\tif isNotFound(err) {\n\t\t\treturn nil, fmt.Errorf(\"unable to find instance in compute API: %w\", err)\n\t\t}\n\t\treturn nil, fmt.Errorf(\"error fetching instance from compute API: %w\", err)\n\t}\n\n\tif !strings.HasPrefix(lastComponent(instance.Zone), v.opt.Region+\"-\") {\n\t\treturn nil, fmt.Errorf(\"instance was in zone %q, expected region %q\", instance.Zone, v.opt.Region)\n\t}","sourceCodeStart":103,"sourceCodeEnd":139,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/upup/pkg/fi/cloudup/gce/tpm/gcetpmverifier/tpmverifier.go#L103-L139","documentation":"The token must name the requesting instance so the verifier can query the Compute API and confirm the VM exists, is in the right region, and carries the cluster's metadata/labels. An empty Instance field is rejected.","triggerScenarios":"VerifyToken receives a token whose tokenData.Instance field is empty.","commonSituations":"Token producer failed to read the instance name from metadata (`instance/name`), client built before the Instance claim existed, or test tokens constructed without it.","solutions":["Populate the instance name claim from GCE instance metadata when minting the token.","Align the client token schema with the verifier's TokenData struct.","Regenerate the node's token after fixing the producer; restart the node service if it caches tokens."],"exampleFix":"// before\ntokenData := gcetpm.TokenData{GCPProjectID: projectID, Zone: zone}\n// after\nname, _ := metadata.InstanceName()\ntokenData := gcetpm.TokenData{GCPProjectID: projectID, Zone: zone, Instance: name}","handlingStrategy":"validation","validationCode":"if tokenData.Instance == \"\" {\n\treturn fmt.Errorf(\"token missing instance name; read it from instance/name metadata\")\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Populate instance name from GCE metadata at token mint time","Validate all required claims before sending","Restart node services after fixing the token producer"],"tags":["gcp","tpm","validation","missing-field"],"backgroundTag":"missing-required-argument","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T07:17:12.445Z"}