kubernetes/kops · error

clusterName does not match expected: got %q, want %q

Error message

clusterName does not match expected: got %q, want %q

What it means

VerifyToken rejects a node token because the instance's cluster-lifecycle metadata (`k3s.io/cluster-name` style cluster-name metadata item) names a cluster other than the one this verifier was configured for (v.opt.ClusterName). This is a deliberate cross-cluster guard: the verifier only trusts instances that provably belong to the cluster it serves.

Source

Thrown at upup/pkg/fi/cloudup/gce/tpm/gcetpmverifier/tpmverifier.go:159

	clusterName := ""
	instanceGroupName := ""
	for _, item := range instance.Metadata.Items {
		switch item.Key {
		case gce.MetadataKeyInstanceGroupName:
			instanceGroupName = fi.ValueOf(item.Value)
		case gcemetadata.MetadataKeyClusterName:
			clusterName = fi.ValueOf(item.Value)
		}
	}

	capgRole := instance.Labels[gce.LabelKeyCAPIRoleName]

	if clusterName == "" {
		return nil, fmt.Errorf("could not determine cluster for instance %s", instance.SelfLink)
	}

	if clusterName != v.opt.ClusterName {
		return nil, fmt.Errorf("clusterName does not match expected: got %q, want %q", clusterName, v.opt.ClusterName)
	}

	var capiMachine *clusterapi.Machine

	if v.capiManager != nil && capgRole != "" {
		providerID := "gce://" + tokenData.GCPProjectID + "/" + tokenData.Zone + "/" + tokenData.Instance

		m, err := v.capiManager.FindMachineByProviderID(ctx, providerID)
		if err != nil {
			return nil, fmt.Errorf("error finding Machine with providerID %q: %w", providerID, err)
		}
		capiMachine = m
	}

	// Check if this is a CAPG managed instance
	if instanceGroupName == "" && capiMachine == nil {
		return nil, fmt.Errorf("could not determine ownership for instance %s", instance.SelfLink)
	}

View on GitHub (pinned to 4c8573c808)

Solutions

1. Confirm the verifier was started with the same --cluster name as the cluster that stamped the instance metadata
2. Check the instance's cluster-name metadata item in the GCE console and fix it if stale
3. Verify the request is coming from the intended cluster's nodes at all; if cross-cluster, point that cluster at its own verifier
4. If the cluster was intentionally renamed, update instance metadata to the new cluster name

Example fix

// before
v, _ := NewTPMVerifier(ctx, opt) // opt.ClusterName = "wrong.example.com"
// after
opt.ClusterName = "actual.example.com" // must match instance metadata cluster name
v, _ := NewTPMVerifier(ctx, opt)

// before contacting the verifier, ensure node metadata matches the expected cluster
inst, err := computeClient.Instances.Get(proj, zone, name).Context(ctx).Do()
if err != nil { return err }
var clusterName string
for _, it := range inst.Metadata.Items {
    if it.Key == "cluster-name" { clusterName = fi.ValueOf(it.Value) }
}
if clusterName == "" || clusterName != expectedClusterName {
    return fmt.Errorf("instance %s belongs to cluster %q, not %q", name, clusterName, expectedClusterName)
}

When it happens

Trigger: A node instance with the gce-cluster-name metadata set to a different cluster calls the TPM verifier endpoint; or the verifier's ClusterName option is misconfigured relative to the metadata value stamped on instances; or an instance was migrated/reused between clusters keeping stale metadata.

Common situations: Reusing an instance group or MIG across two kOps clusters; typo'd --cluster name when starting the verifier/server; shared VPC with instances from multiple clusters hitting the same verifier; rebuild of a cluster reusing the same GCE project with a renamed cluster.

Related errors

• could not determine ownership for instance %s
• failed to get GCE RSA attestation key from TPM: %w
• failed to marshal token data: %w
• failed to marshal token: %w
• decoding authorization token: %w

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/81ec575af8cffb9a. Report an issue: GitHub.