kubernetes/kops · error

error fetching oauth2 token info: %v

Error message

error fetching oauth2 token info: %v

What it means

Wraps the Tokeninfo API call failure in getTokenInfo: the access token was obtained, but querying its metadata via oauth2 Tokeninfo failed — invalid token, API errors, or connectivity. Purely diagnostic path, but treated as a hard error at this site.

Source

Thrown at upup/pkg/fi/cloudup/gce/gce_cloud.go:420

	if err != nil {
		return nil, fmt.Errorf("error building token source: %v", err)
	}

	token, err := tokenSource.Token()
	if err != nil {
		return nil, fmt.Errorf("error getting token: %v", err)
	}

	// Note: do not log token or any portion of it

	service, err := oauth2.NewService(ctx)
	if err != nil {
		return nil, fmt.Errorf("error creating oauth2 service: %v", err)
	}

	tokenInfo, err := service.Tokeninfo().AccessToken(token.AccessToken).Do()
	if err != nil {
		return nil, fmt.Errorf("error fetching oauth2 token info: %v", err)
	}

	return tokenInfo, nil
}

// SplitServiceAccountEmail splits service account email
func SplitServiceAccountEmail(email string) (string, string, error) {
	accountID := ""
	projectID := ""

	tokens := strings.Split(email, "@")
	if len(tokens) == 2 {
		accountID = tokens[0]
		if strings.HasSuffix(tokens[1], ".iam.gserviceaccount.com") {
			projectID = strings.TrimSuffix(tokens[1], ".iam.gserviceaccount.com")
		}
	}

View on GitHub (pinned to 4c8573c808)

Solutions

1. Verify the token is valid (re-auth if revoked)
2. Check connectivity to the OAuth2 API
3. Inspect the wrapped error

When it happens

Trigger: Thrown at upup/pkg/fi/cloudup/gce/gce_cloud.go:420 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/db7840652bac066d. Report an issue: GitHub.