kubernetes/kops · error

error finding Machine with providerID %q: %w

Error message

error finding Machine with providerID %q: %w

What it means

When the instance carries the CAPI (Cluster API) role label, IdentifyNode asks the capiManager to find the matching cluster-api Machine object by providerID, wrapping any underlying error (K8s client failure, etc.) with this message. It indicates the Machine lookup itself failed, not merely that no Machine was found.

Source

Thrown at pkg/nodeidentity/gce/identify.go:137

	if err != nil {
		return nil, err
	}

	instanceStatus := instance.Status
	if instanceStatus != "RUNNING" {
		return nil, fmt.Errorf("found instance %q, but status is %q", instanceName, instanceStatus)
	}

	capgRole := instance.Labels[LabelKeyCAPIRoleName]

	var capiMachine *clusterapi.Machine

	if i.capiManager != nil && capgRole != "" {
		providerID := "gce://" + project + "/" + zone + "/" + instanceName

		m, err := i.capiManager.FindMachineByProviderID(ctx, providerID)
		if err != nil {
			return nil, fmt.Errorf("error finding Machine with providerID %q: %w", providerID, err)
		}
		capiMachine = m
	}

	var igName string
	if capiMachine == nil {
		// The metadata itself is potentially mutable from the instance
		// We instead look at the MIG configuration
		createdBy := getMetadataValue(instance.Metadata, "created-by")
		if createdBy == "" {
			return nil, fmt.Errorf("cannot find owner for instance %s", instance.Name)
		}

		// We need to double-check the MIG configuration, in case created-by was changed
		migName := lastComponent(createdBy)

		mig, err := i.getMIG(zone, migName)
		if err != nil {

View on GitHub (pinned to 4c8573c808)

Solutions

1. Check connectivity/RBAC to the cluster-api management cluster: verify the controller's ServiceAccount can get/list machine.cluster.x-k8s.io resources.
2. Verify the capiManager was initialized with the correct management cluster kubeconfig.
3. Inspect the wrapped inner error (%w) in logs — it names the actual client/CRD failure.
4. If the cluster does not use CAPG, ensure instances are not labeled with the CAPI role label, or don't configure a capiManager.

Example fix

// before
m, err := i.capiManager.FindMachineByProviderID(ctx, providerID)
if err != nil { return nil, fmt.Errorf("error finding Machine with providerID %q: %w", providerID, err) }
// after — only attempt lookup when manager healthy and label present
if i.capiManager != nil && capgRole != "" && i.capiManager.Healthy(ctx) {
    m, err := i.capiManager.FindMachineByProviderID(ctx, providerID)
    if err != nil { return nil, fmt.Errorf("error finding Machine with providerID %q: %w", providerID, err) }
    capiMachine = m
}

if i.capiManager != nil && instance.Labels[LabelKeyCAPIRoleName] != "" {
    // ensure management cluster reachable first
    if err := i.capiManager.Ping(ctx); err != nil {
        return fmt.Errorf("management cluster unreachable, skipping Machine lookup: %w", err)
    }
}

func canLookupMachine(i *nodeIdentifier, instance *compute.Instance) bool {
    return i != nil && i.capiManager != nil && instance.Labels[LabelKeyCAPIRoleName] != ""
}

info, err := identifier.IdentifyNode(ctx, node)
var apiErr *googleapi.Error
if err != nil {
    if errors.Is(err, context.DeadlineExceeded) || errors.As(err, &apiErr) {
        // fall back to legacy MIG path or requeue
        return fallbackIdentify(node)
    }
    return err
}

When it happens

Trigger: Instance has label LabelKeyCAPIRoleName set and i.capiManager != nil, but FindMachineByProviderID returns an error — e.g. the Machine informer/client cannot reach the API server, RBAC denies list/get on machine.cluster.x-k8s.io, or the underlying providerID index lookup errors.

Common situations: ClusterAPI management cluster unreachable or creds expired; missing RBAC (ClusterRole) for the node-identity controller to read Machines; CAPG controller not installed so the Machine CRD/client fails; network partition between controller and management apiserver.

Related errors

• error adding needs-update label: %v
• error applying annotation to record addon installation: %v
• error querying namespace %q: %v
• error applying annotation to namespace: %v
• failed to apply objects: %w

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/a14c6121c85b92cb. Report an issue: GitHub.