kubernetes/kops · critical

error building node identifier: %w

Error message

error building node identifier: %w

What it means

addNodeController failed to construct the cloud node identifier during startup. For each configured cloud (aws, gce, ...) the New() constructor is called; its initialization error (AWS session/EC2 client setup, GCE service setup) is wrapped with this message and main exits.

Source

Thrown at cmd/kops-controller/main.go:325

		}
	}

	return scheme, nil
}

func addNodeController(ctx context.Context, mgr manager.Manager, opt *config.Options) error {
	var capiManager *capimanager.Manager
	if opt.CAPI.IsEnabled() {
		capiManager = capimanager.NewManager(mgr.GetClient())
	}

	var identifier nodeidentity.Identifier
	var err error
	switch opt.Cloud {
	case "aws":
		identifier, err = nodeidentityaws.New(ctx, opt.CacheNodeidentityInfo)
		if err != nil {
			return fmt.Errorf("error building node identifier: %w", err)
		}

	case "gce":
		identifier, err = nodeidentitygce.New(opt.ClusterName, capiManager)
		if err != nil {
			return fmt.Errorf("error building node identifier: %w", err)
		}

	case "openstack":
		identifier, err = nodeidentityos.New(opt.CacheNodeidentityInfo)
		if err != nil {
			return fmt.Errorf("error building node identifier: %w", err)
		}

	case "digitalocean":
		identifier, err = nodeidentitydo.New(opt.CacheNodeidentityInfo)
		if err != nil {
			return fmt.Errorf("error building node identifier: %w", err)

View on GitHub (pinned to 4c8573c808)

Solutions

1. Read the wrapped error from nodeidentity*.New for the root cause
2. Verify cloud credentials and region env (AWS_REGION / GOOGLE_APPLICATION_CREDENTIALS) are set in the controller pod
3. Confirm --cloud flag matches a supported value (aws, gce, ...)
4. For GCE, verify opt.ClusterName is set correctly

Example fix

// before: missing region
// container env: no AWS_REGION
// after
env:
- name: AWS_REGION
  value: us-east-1

switch opt.Cloud {
case "aws", "gce":
default:
	return fmt.Errorf("unsupported cloud %q", opt.Cloud)
}

identifier, err = nodeidentityaws.New(ctx, opt.CacheNodeidentityInfo)
if err != nil {
	return fmt.Errorf("error building node identifier: %w", err)
}

When it happens

Trigger: nodeidentityaws.New fails (e.g. AWS config/session creation error) or nodeidentitygce.New fails (GCE credentials/service client error) for the cloud matching opt.Cloud.

Common situations: Missing or invalid cloud credentials/environment (AWS_REGION unset, GCP credentials not mounted), unsupported opt.Cloud value (falls through to an error for unknown clouds), or invalid cluster name for GCE.

Related errors

• error identifying node %q: %v
• creating aws IPAM controller: %w
• creating gce IPAM controller: %w
• error finding CloudInstanceGroups: %v
• error getting GCE DNS zones %v

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/25416f4567d8bb4e. Report an issue: GitHub.