kubernetes/kops · error

error fetching GCE instance group template %q: %v

Error message

error fetching GCE instance group template %q: %v

What it means

kops' GCE node identity lookup could not retrieve the named instance template from the Google Compute Engine API while resolving which template a node's managed instance group uses. It wraps the raw googleapi error with the template name for context. The InstanceTemplates.Get call can fail due to API errors, permissions, or the template no longer existing.

Source

Thrown at pkg/nodeidentity/gce/identify.go:227

	info.Labels = labels
	return info, nil
}

// getInstance queries GCE for the instance with the specified name, returning an error if not found
func (i *nodeIdentifier) getInstance(zone string, instanceName string) (*compute.Instance, error) {
	instance, err := i.computeService.Instances.Get(i.project, zone, instanceName).Do()
	if err != nil {
		return nil, fmt.Errorf("error fetching GCE instance: %w", err)
	}

	return instance, nil
}

// getInstanceTemplate queries GCE for the IG Template with the specified name, returning an error if not found
func (i *nodeIdentifier) getInstanceTemplate(name string) (*compute.InstanceTemplate, error) {
	t, err := i.computeService.InstanceTemplates.Get(i.project, name).Do()
	if err != nil {
		return nil, fmt.Errorf("error fetching GCE instance group template %q: %v", name, err)
	}

	return t, nil
}

// getMIG queries GCE for the MIG with the specified name, returning an error if not found
func (i *nodeIdentifier) getMIG(zone string, migName string) (*compute.InstanceGroupManager, error) {
	mig, err := i.computeService.InstanceGroupManagers.Get(i.project, zone, migName).Do()
	if err != nil {
		return nil, fmt.Errorf("error fetching GCE managed instance group %q: %v", migName, err)
	}

	return mig, nil
}

// getManagedInstance queries GCE for the instance from the MIG
func (i *nodeIdentifier) getManagedInstance(ctx context.Context, mig *compute.InstanceGroupManager, instanceID uint64) (*compute.ManagedInstance, error) {
	var matches []*compute.ManagedInstance

View on GitHub (pinned to 4c8573c808)

Solutions

1. Verify the instance template still exists: gcloud compute instance-templates describe <name> --project <project>
2. Check the service account has compute.instanceTemplates.get permission (roles/compute.viewer)
3. Re-run kops update/rolling-update so MIGs reference current templates
4. If the error is transient (5xx/rate limit), retry after backoff

Example fix

// before: error surfaces with wrapped message only
// after: log template name and project for faster diagnosis
if err != nil {
  return nil, fmt.Errorf("error fetching GCE instance group template %q in project %s: %w", name, i.project, err)
}

if _, err := gcloudLikeCheck(name); err != nil { /* skip or recreate template */ }

func templateFound(t *compute.InstanceTemplate, err error) bool { return err == nil && t != nil }

t, err := getInstanceTemplate(name)
if err != nil {
  if isNotFound(err) { /* recreate template via kops update */ }
  else if isTransient(err) { /* backoff retry */ }
  return err
}

When it happens

Trigger: i.computeService.InstanceTemplates.Get(project, name).Do() returns an error: template deleted, wrong project, permission denied (compute.instanceTemplates.get), quota/rate-limit, or transient API outage.

Common situations: Instance template renamed or recreated by a kops update while an old node still reports to the cluster; GCE API credentials lacking compute viewer role; typos/mismatch of project after cluster migration.

Related errors

• error fetching GCE instance: %w
• error fetching GCE managed instance group %q: %v
• error building metal node identifier: %w
• error building linode node identifier: %w
• providerID was not set for node %s

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/b140db9dc7fd7711. Report an issue: GitHub.