kubernetes/kops · error

error building compute API client: %v

Error message

error building compute API client: %v

What it means

New() builds the GCE node identifier and first constructs a compute.Service via compute.NewService, which relies on Application Default Credentials. If client construction fails (bad credentials, missing google API client config, transport errors), this error wraps the cause.

Source

Thrown at pkg/nodeidentity/gce/identify.go:66

	computeService *compute.Service

	// project is our GCE project; we require that instances be in this project
	project string

	// clusterName is the metadata.name of our cluster
	clusterName string

	// capiManager contains our CAPI support, if CAPI support is enabled
	capiManager *capimanager.Manager
}

// New creates and returns a nodeidentity.Identifier for Nodes running on GCE
func New(clusterName string, capiManager *capimanager.Manager) (nodeidentity.Identifier, error) {
	ctx := context.Background()

	computeService, err := compute.NewService(ctx)
	if err != nil {
		return nil, fmt.Errorf("error building compute API client: %v", err)
	}

	// Project ID
	project := os.Getenv("GCP_PROJECT")
	if project != "" {
		klog.Infof("using project=%q from GCP_PROJECT env var", project)
	} else {
		project, err = metadata.ProjectID()
		if err != nil {
			return nil, fmt.Errorf("error reading project from GCE: %v", err)
		}
		project = strings.TrimSpace(project)
		if project == "" {
			return nil, fmt.Errorf("project metadata was empty")
		}
		klog.Infof("Found project=%q", project)
	}

View on GitHub (pinned to 4c8573c808)

Solutions

1. Set GOOGLE_APPLICATION_CREDENTIALS to a valid service-account JSON key with compute scope, or configure workload identity
2. Ensure the instance/pod has the compute.readonly or compute scope and that the Compute Engine API is enabled in the project
3. Verify the credentials JSON parses and the key is not revoked (gcloud auth application-default print-access-token)
4. Confirm the google.golang.org/api compute package is correctly initialized in the deployment (no stripped default client)

Example fix

// before
# no credentials configured
// after
export GOOGLE_APPLICATION_CREDENTIALS=/etc/gcp/service-account.json

creds := os.Getenv("GOOGLE_APPLICATION_CREDENTIALS")
if creds == "" {
    if _, err := metadata.ProjectID(); err != nil {
        return errors.New("no GCP credentials or metadata server available")
    }
}
if _, err := tokenSourceToken(ctx); err != nil {
    return fmt.Errorf("GCP credentials invalid: %w", err)
}

ident, err := nodeidentitygce.New(clusterName, capiManager)
if err != nil {
    if strings.Contains(err.Error(), "error building compute API client") {
        // fix GOOGLE_APPLICATION_CREDENTIALS or instance scopes, then restart
    }
}

When it happens

Trigger: compute.NewService(ctx) fails: no Application Default Credentials available on the controller host/pod, malformed GOOGLE_APPLICATION_CREDENTIALS, or failure initializing the compute API client.

Common situations: Controller not running on GCE and no service-account key provided; GOOGLE_APPLICATION_CREDENTIALS pointing to a missing/invalid JSON key; workload identity/firmware misconfiguration on the GKE/kops-on-GCE controller; missing compute API scopes on the instance.

Related errors

• error building compute API client: %w
• creating gce IPAM controller: %w
• error listing zones: %v
• unable to determine zones in region %q
• error getting ForwardingRule %q: %w

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/3da0c828fe6f3098. Report an issue: GitHub.