kubernetes/kops · error

error fetching instance from compute API: %w

Error message

error fetching instance from compute API: %w

What it means

The Compute API call Instances.Get failed with an error other than 404 (e.g. quota, permission, throttling, or API outage). The verifier cannot confirm the instance's existence or metadata, so token verification fails.

Source

Thrown at upup/pkg/fi/cloudup/gce/tpm/gcetpmverifier/tpmverifier.go:134

	}
	if tokenData.Zone == "" {
		return nil, fmt.Errorf("zone is required")
	}
	if tokenData.Instance == "" {
		return nil, fmt.Errorf("instance is required")
	}

	// Verify node is in our cluster
	if tokenData.GCPProjectID != v.opt.ProjectID {
		return nil, fmt.Errorf("projectID does not match expected: got %q, want %q", tokenData.GCPProjectID, v.opt.ProjectID)
	}

	instance, err := v.computeClient.Instances.Get(tokenData.GCPProjectID, tokenData.Zone, tokenData.Instance).Context(ctx).Do()
	if err != nil {
		if isNotFound(err) {
			return nil, fmt.Errorf("unable to find instance in compute API: %w", err)
		}
		return nil, fmt.Errorf("error fetching instance from compute API: %w", err)
	}

	if !strings.HasPrefix(lastComponent(instance.Zone), v.opt.Region+"-") {
		return nil, fmt.Errorf("instance was in zone %q, expected region %q", instance.Zone, v.opt.Region)
	}

	clusterName := ""
	instanceGroupName := ""
	for _, item := range instance.Metadata.Items {
		switch item.Key {
		case gce.MetadataKeyInstanceGroupName:
			instanceGroupName = fi.ValueOf(item.Value)
		case gcemetadata.MetadataKeyClusterName:
			clusterName = fi.ValueOf(item.Value)
		}
	}

	capgRole := instance.Labels[gce.LabelKeyCAPIRoleName]

View on GitHub (pinned to 4c8573c808)

Solutions

1. Inspect the wrapped error (%w) for the underlying googleapi status code and message.
2. Grant the verifier's service account roles/compute.viewer (or compute.instances.get) on the project.
3. Enable the Compute Engine API for the project and retry; add backoff/retry for 429/5xx errors.
4. Check GCP status for regional Compute API incidents.

Example fix

// before: no compute role
// verifier SA: roles/none
// after
gcloud projects add-iam-policy-binding PROJECT --member serviceAccount:VERIFIER_SA --role roles/compute.viewer

// pre-check IAM: verifier SA has compute.instances.get on the project
// and Compute Engine API is enabled

var gerr *googleapi.Error
if errors.As(err, &gerr) {
	switch {
	case gerr.Code == 429 || gerr.Code >= 500:
		// exponential backoff and retry
	case gerr.Code == 403:
		// surface IAM misconfiguration to operator
	}
}

When it happens

Trigger: computeClient.Instances.Get(...).Do() returns a non-NotFound error — 403 for missing compute.instances.get permission, 429 rate limiting, 5xx from GCE, or network failure from the verifier.

Common situations: Verifier's service account lacks Compute Viewer role, GCE API rate limits exceeded during mass node join, regional API outages, or the Compute Engine API disabled on the project.

Related errors

• unable to determine gcp network for cluster
• error fetching network %q: %w
• unable to find instance in compute API: %w
• error querying bucket %q: %v
• getting location for bucket %q: %w

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/6a70ade923f037c3. Report an issue: GitHub.