kubernetes/kops · error

error building token source: %v

Error message

error building token source: %v

What it means

Wraps google.DefaultTokenSource failure in getTokenInfo, which resolves the active credential's OAuth token info for diagnostic logging during GCE cloud construction. Fires when no Application Default Credentials are available.

Source

Thrown at upup/pkg/fi/cloudup/gce/gce_cloud.go:403

	}

	var matches []*compute.InstanceTemplate
	for _, t := range ts {
		if !gcemetadata.MetadataMatchesClusterName(findClusterName, t.Properties.Metadata) {
			continue
		}

		matches = append(matches, t)
	}

	return matches, nil
}

// logTokenInfo returns information about the active credential
func (c *gceCloudImplementation) getTokenInfo(ctx context.Context) (*oauth2.Tokeninfo, error) {
	tokenSource, err := google.DefaultTokenSource(ctx, compute.CloudPlatformScope)
	if err != nil {
		return nil, fmt.Errorf("error building token source: %v", err)
	}

	token, err := tokenSource.Token()
	if err != nil {
		return nil, fmt.Errorf("error getting token: %v", err)
	}

	// Note: do not log token or any portion of it

	service, err := oauth2.NewService(ctx)
	if err != nil {
		return nil, fmt.Errorf("error creating oauth2 service: %v", err)
	}

	tokenInfo, err := service.Tokeninfo().AccessToken(token.AccessToken).Do()
	if err != nil {
		return nil, fmt.Errorf("error fetching oauth2 token info: %v", err)
	}

View on GitHub (pinned to 4c8573c808)

Solutions

1. Configure ADC (gcloud auth application-default login or GOOGLE_APPLICATION_CREDENTIALS)
2. Check the wrapped error for the credential chain failure

When it happens

Trigger: Thrown at upup/pkg/fi/cloudup/gce/gce_cloud.go:403 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/cb648282ba00e23c. Report an issue: GitHub.