kubernetes/kops · error

error creating oauth2 service: %v

Error message

error creating oauth2 service: %v

What it means

getTokenInfo wraps oauth2.NewService failure while building the tokeninfo service to log non-secret credential info. It fires on credential/environment problems; notably the code never logs the token itself, only service construction is affected.

Source

Thrown at upup/pkg/fi/cloudup/gce/gce_cloud.go:415

}

// logTokenInfo returns information about the active credential
func (c *gceCloudImplementation) getTokenInfo(ctx context.Context) (*oauth2.Tokeninfo, error) {
	tokenSource, err := google.DefaultTokenSource(ctx, compute.CloudPlatformScope)
	if err != nil {
		return nil, fmt.Errorf("error building token source: %v", err)
	}

	token, err := tokenSource.Token()
	if err != nil {
		return nil, fmt.Errorf("error getting token: %v", err)
	}

	// Note: do not log token or any portion of it

	service, err := oauth2.NewService(ctx)
	if err != nil {
		return nil, fmt.Errorf("error creating oauth2 service: %v", err)
	}

	tokenInfo, err := service.Tokeninfo().AccessToken(token.AccessToken).Do()
	if err != nil {
		return nil, fmt.Errorf("error fetching oauth2 token info: %v", err)
	}

	return tokenInfo, nil
}

// SplitServiceAccountEmail splits service account email
func SplitServiceAccountEmail(email string) (string, string, error) {
	accountID := ""
	projectID := ""

	tokens := strings.Split(email, "@")
	if len(tokens) == 2 {
		accountID = tokens[0]

View on GitHub (pinned to 4c8573c808)

Solutions

1. Check network access to googleapis.com
2. Inspect the wrapped error
3. Retry the operation

When it happens

Trigger: Thrown at upup/pkg/fi/cloudup/gce/gce_cloud.go:415 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/a5c2b520582f1f5f. Report an issue: GitHub.