kubernetes/kops · error

did not find owner for node %q

Error message

did not find owner for node %q

What it means

getNodeConfig requires knowing which InstanceGroup owns the node before it can build a NodeConfig. If identity.InstanceGroupName is empty and the verified identity carries no CAPI Machine object, the server has no owner information for the node and rejects the request with the node's name. The InstanceGroup name is essential because the nodeup config is stored per InstanceGroup under configBase.

Source

Thrown at cmd/kops-controller/pkg/server/node_config.go:46

	"k8s.io/kops/pkg/apis/nodeup"
	"k8s.io/kops/pkg/bootstrap"
	"k8s.io/kops/pkg/commands"
	"k8s.io/kops/pkg/nodeidentity/clusterapi"
)

func (s *Server) getNodeConfig(ctx context.Context, req *nodeup.BootstrapRequest, identity *bootstrap.VerifyResult) (*nodeup.NodeConfig, error) {
	log := klog.FromContext(ctx)

	if identity == nil {
		return nil, fmt.Errorf("node identity is required")
	}

	log.Info("getting node config", "req", req, "identity", identity)

	instanceGroupName := identity.InstanceGroupName
	if instanceGroupName == "" {
		if identity.CAPIMachine == nil {
			return nil, fmt.Errorf("did not find owner for node %q", identity.NodeName)
		}
		// CAPI path: the InstanceGroup is synthesized from the Machine and
		// the name never reaches the configBase path, so we don't validate it.
	} else if errs := kopsvalidation.ValidateInstanceGroupName(instanceGroupName, field.NewPath("instanceGroupName")); len(errs) > 0 {
		return nil, fmt.Errorf("invalid InstanceGroup name: %v", errs.ToAggregate())
	}

	var nodeConfig *nodeup.NodeConfig

	configBuilder := &commands.ConfigBuilder{
		Clientset:   s.clientset,
		ClusterName: s.opt.ClusterName,
	}

	if identity.CAPIMachine != nil && instanceGroupName == "" {
		// We have a CAPI Machine (but no instance group)
		instanceGroup, err := s.buildInstanceGroupFromCAPI(ctx, identity.CAPIMachine)
		if err != nil {

View on GitHub (pinned to 4c8573c808)

Solutions

1. Verify the node exists in the cloud provider account/region kops-controller is configured for and that its IAM role permits the metadata lookups used during verification
2. If using Cluster API, enable/deploy the CAPI integration so identity.CAPIMachine is populated (machine-controller must be able to list Machines)
3. Confirm the InstanceGroup still exists and the node's tags/labels map back to it; recreate the node if it was orphaned
4. Check kops-controller logs for the verification step to see which lookup failed to resolve ownership

ig, err := resolveInstanceGroupForNode(node)
if err != nil || ig == "" {
	return fmt.Errorf("cannot resolve InstanceGroup owner for node %s", node)
}

if err != nil && strings.Contains(err.Error(), "did not find owner for node") {
	// node has no InstanceGroup/CAPI Machine mapping; recreate or re-tag the node
}

When it happens

Trigger: A node successfully passes identity verification (identity is non-nil) but identity.InstanceGroupName == "" and identity.CAPIMachine == nil. This means the verification method used could not map the node's cloud identity to either a kops InstanceGroup or a Cluster API Machine.

Common situations: Running kops-controller without the CAPI integration while nodes are actually CAPI Machines; the cloud provider's instanceID/name lookup returned nothing (e.g. instance was deleted, wrong region/account, IAM permissions missing for the metadata API); ASG/InstanceGroup tags missing so ownership cannot be resolved.

Related errors

• error building InstanceGroup from CAPI Machine: %w
• node identity is required
• invalid InstanceGroup name: %v
• error loading NodeupConfig %q: %v
• CAPI Machine is missing cluster.x-k8s.io/deployment-name lab

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/c0f46971cd03b8d2. Report an issue: GitHub.