kubernetes/kops · error

DIGITALOCEAN_ACCESS_TOKEN is required

Error message

DIGITALOCEAN_ACCESS_TOKEN is required

What it means

Wraps a failure of awsBuildCloudInstanceGroup in getCloudGroups. After matching an ASG to a kops instance group, kOps builds a CloudInstanceGroup joining ASG members with Kubernetes nodes; a failure there (e.g. error resolving the ASG's launch configuration/template) is wrapped with the instance group name.

Source

Thrown at pkg/nodeidentity/do/identify.go:90

		return nil, fmt.Errorf("failed to initialize digitalocean cloud: %s", err)
	}

	return &nodeIdentifier{
		doClient:     doClient,
		cache:        expirationcache.NewTTLStore(stringKeyFunc, cacheTTL),
		cacheEnabled: cacheNodeidentityInfo,
	}, nil
}

func getMetadataRegion() (string, error) {
	return getMetadata(dropletRegionMetadataURL)
}

// NewCloud returns a godo client, expecting the env var DIGITALOCEAN_ACCESS_TOKEN to be set.
func NewCloud(region string) (*godo.Client, error) {
	accessToken := os.Getenv("DIGITALOCEAN_ACCESS_TOKEN")
	if accessToken == "" {
		return nil, errors.New("DIGITALOCEAN_ACCESS_TOKEN is required")
	}

	tokenSource := &TokenSource{AccessToken: accessToken}
	oauthClient := oauth2.NewClient(context.TODO(), tokenSource)
	return godo.NewClient(oauthClient), nil
}

func getMetadata(url string) (string, error) {
	resp, err := http.Get(url)
	if err != nil {
		return "", fmt.Errorf("failed to get metadata URL %s: %v", url, err)
	}

	defer resp.Body.Close()

	if resp.StatusCode != http.StatusOK {
		return "", fmt.Errorf("droplet metadata returned non-200 status code: %d", resp.StatusCode)
	}

View on GitHub (pinned to 4c8573c808)

Solutions

1. Check the ASG has a valid launch template or launch configuration in the AWS console
2. Upgrade/downgrade kOps to a version matching the cluster's launch template vs configuration setup
3. Re-create the ASG via `kops update cluster` if its launch template was deleted
4. Run `kops rolling-update cluster` after fixing to refresh group state

out, _ := cloud.Autoscaling().DescribeAutoScalingGroups(ctx, &autoscaling.DescribeAutoScalingGroupsInput{AutoScalingGroupNames: []string{asgName}})
g := out.AutoScalingGroups[0]
if g.LaunchTemplate == nil && g.MixedInstancesPolicy == nil && g.LaunchConfigurationName == nil { return fmt.Errorf("ASG %q has no launch spec", asgName) }

func hasLaunchSpec(g *autoscalingtypes.AutoScalingGroup) bool {
  return g.LaunchTemplate != nil || (g.MixedInstancesPolicy != nil && g.MixedInstancesPolicy.LaunchTemplate != nil) || g.LaunchConfigurationName != nil
}

groups, err := cloud.GetCloudGroups(ctx, cluster, igs, true, nodes)
if err != nil && strings.Contains(err.Error(), "error getting cloud instance group") {
  // repair the ASG's launch template via kops update cluster, then retry
}

When it happens

Trigger: awsBuildCloudInstanceGroup fails resolving the ASG's launch template/configuration: LaunchTemplateSpecification missing, describe-launch-template API error, or nil LaunchConfigurationName for legacy ASGs.

Common situations: ASG using a launch configuration on a kOps version expecting launch templates (or vice versa); ASG mutated externally; launch template deleted while ASG still references it during rolling-update listing.

Related errors

• errShutdown
• expected a aws.Cloud provider
• could not find one of launch template or mixed instances pol
• DIGITALOCEAN_ACCESS_TOKEN is required
• the image for the hook exec action not set

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/15e30edb647d64de. Report an issue: GitHub.