kubernetes/kops · error

error getting projectID from metadata: %w

Error message

error getting projectID from metadata: %w

What it means

Wraps metadata.ProjectID failure in the GCE TPM authenticator: the project ID could not be read from the instance metadata server. Fires when the process is not running on a GCE instance or the metadata server is unreachable.

Source

Thrown at upup/pkg/fi/cloudup/gce/tpm/gcetpmsigner/tpmauthenticator.go:48

	"cloud.google.com/go/compute/metadata"
	"github.com/google/go-tpm-tools/client"
	"k8s.io/klog/v2"
	"k8s.io/kops/pkg/bootstrap"
	gcetpm "k8s.io/kops/upup/pkg/fi/cloudup/gce/tpm"
)

type tpmAuthenticator struct {
	projectID string
	zone      string
	instance  string
}

var _ bootstrap.Authenticator = (*tpmAuthenticator)(nil)

func NewTPMAuthenticator() (bootstrap.Authenticator, error) {
	projectID, err := metadata.ProjectID()
	if err != nil {
		return nil, fmt.Errorf("error getting projectID from metadata: %w", err)
	}
	zone, err := metadata.Zone()
	if err != nil {
		return nil, fmt.Errorf("error getting zone from metadata: %w", err)
	}
	instance, err := metadata.InstanceName()
	if err != nil {
		return nil, fmt.Errorf("error getting instance from metadata: %w", err)
	}

	return &tpmAuthenticator{
		projectID: projectID,
		zone:      zone,
		instance:  instance,
	}, nil
}

func (a *tpmAuthenticator) CreateToken(body []byte) (string, error) {

View on GitHub (pinned to 4c8573c808)

Solutions

1. Run the authenticator on a GCE instance
2. Check metadata server connectivity (169.254.169.254)
3. Inspect the wrapped error

When it happens

Trigger: Thrown at upup/pkg/fi/cloudup/gce/tpm/gcetpmsigner/tpmauthenticator.go:48 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/702134b1062d2d14. Report an issue: GitHub.