{"record":{"id":"d1b2e63918951938","repo":"kubernetes/kops","slug":"error-identifying-node-q-v","errorCode":null,"errorMessage":"error identifying node %q: %v","messagePattern":"error identifying node %q: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"cmd/kops-controller/controllers/node_controller.go","lineNumber":90,"sourceCode":"// Reconcile is the main reconciler function that observes node changes.\nfunc (r *NodeReconciler) Reconcile(ctx context.Context, req ctrl.Request) (ctrl.Result, error) {\n\t_ = r.log.WithValues(\"nodecontroller\", req.NamespacedName)\n\n\tnode := &corev1.Node{}\n\tif err := r.client.Get(ctx, req.NamespacedName, node); err != nil {\n\t\tklog.Warningf(\"unable to fetch node %s: %v\", node.Name, err)\n\t\tif apierrors.IsNotFound(err) {\n\t\t\t// we'll ignore not-found errors, since they can't be fixed by an immediate\n\t\t\t// requeue (we'll need to wait for a new notification), and we can get them\n\t\t\t// on deleted requests.\n\t\t\treturn ctrl.Result{}, nil\n\t\t}\n\t\treturn ctrl.Result{}, err\n\t}\n\n\tinfo, err := r.identifier.IdentifyNode(ctx, node)\n\tif err != nil {\n\t\treturn ctrl.Result{}, fmt.Errorf(\"error identifying node %q: %v\", node.Name, err)\n\t}\n\n\tlabels := info.Labels\n\n\tupdateLabels := make(map[string]string)\n\tfor k, v := range labels {\n\t\tactual, found := node.Labels[k]\n\t\tif !found || actual != v {\n\t\t\tupdateLabels[k] = v\n\t\t}\n\t}\n\n\tdeleteLabels := make(map[string]struct{})\n\tfor k := range node.Labels {\n\t\t// If it is one of our managed labels, \"prune\" values we don't want to be there\n\t\tswitch k {\n\t\tcase nodelabels.RoleLabelAPIServer16, nodelabels.RoleLabelNode16, nodelabels.RoleLabelControlPlane20:\n\t\t\tif _, found := labels[k]; !found {","sourceCodeStart":72,"sourceCodeEnd":108,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/cmd/kops-controller/controllers/node_controller.go#L72-L108","documentation":"The node controller failed to determine the cloud identity of a Node object. kops-controller calls r.identifier.IdentifyNode(ctx, node) to map a Kubernetes Node to cloud provider metadata (instance ID, labels, zones); any underlying failure is wrapped with the node name for context.","triggerScenarios":"IdentifyNode returns an error — e.g. the cloud metadata lookup fails (AWS EC2 DescribeInstances denied/failed), the instance ID cannot be resolved from the provider ID, or the cloud-specific identifier constructor config is wrong.","commonSituations":"IAM permissions missing for the controller's EC2/GCE API calls, node with malformed or empty spec.providerID, network egress blocked to the cloud API, or a node registered before the controller's identifier was properly initialized.","solutions":["Check the wrapped %v error for the root cause (usually an AWS/GCE API permission or throttling failure)","Verify kops-controller IAM role has ec2:DescribeInstances (or GCE compute.instances.get) permissions","Confirm the Node's spec.providerID is set and correctly formatted","Verify network connectivity from the controller pod to the cloud metadata/API endpoints","Restart the controller — reconciliation will retry the node"],"exampleFix":"// before: controller lacks permission, error like UnauthorizedOperation\n// after: attach policy\n{\n  \"Effect\": \"Allow\",\n  \"Action\": [\"ec2:DescribeInstances\"],\n  \"Resource\": [\"*\"]\n}","handlingStrategy":"retry","validationCode":"if node.Spec.ProviderID == \"\" {\n\t// cannot identify yet; skip and requeue\n}\n","typeGuard":null,"tryCatchPattern":"info, err := r.identifier.IdentifyNode(ctx, node)\nif err != nil {\n\tif kerrors.IsNotFound(err) { return ctrl.Result{}, nil }\n\treturn ctrl.Result{RequeueAfter: time.Minute}, fmt.Errorf(\"error identifying node %q: %v\", node.Name, err)\n}\n","preventionTips":["Ensure kops-controller IAM role includes ec2:DescribeInstances / compute.instances.get","Monitor cloud API error rates and add backoff on throttling","Alert on repeated identify failures for the same node","Verify providerID is populated on all Nodes"],"tags":["kubernetes","node-controller","cloud-provider","aws"],"backgroundTag":"node-identity-lookup-failed","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T07:17:12.445Z"}