kubernetes/kops · error

error getting zone from metadata: %w

Error message

error getting zone from metadata: %w

What it means

NewTPMAuthenticator wraps metadata.Zone failure when reading the GCE instance's zone from the metadata server. It fires off-GCE or when the metadata service is unreachable — the TPM-based bootstrap authenticator cannot identify the instance's zone and cannot sign requests.

Source

Thrown at upup/pkg/fi/cloudup/gce/tpm/gcetpmsigner/tpmauthenticator.go:52

	gcetpm "k8s.io/kops/upup/pkg/fi/cloudup/gce/tpm"
)

type tpmAuthenticator struct {
	projectID string
	zone      string
	instance  string
}

var _ bootstrap.Authenticator = (*tpmAuthenticator)(nil)

func NewTPMAuthenticator() (bootstrap.Authenticator, error) {
	projectID, err := metadata.ProjectID()
	if err != nil {
		return nil, fmt.Errorf("error getting projectID from metadata: %w", err)
	}
	zone, err := metadata.Zone()
	if err != nil {
		return nil, fmt.Errorf("error getting zone from metadata: %w", err)
	}
	instance, err := metadata.InstanceName()
	if err != nil {
		return nil, fmt.Errorf("error getting instance from metadata: %w", err)
	}

	return &tpmAuthenticator{
		projectID: projectID,
		zone:      zone,
		instance:  instance,
	}, nil
}

func (a *tpmAuthenticator) CreateToken(body []byte) (string, error) {
	requestHash := sha256.Sum256(body)

	tpmStart := time.Now()

View on GitHub (pinned to 4c8573c808)

Solutions

1. Run on a GCE instance with metadata access
2. Check metadata server reachability
3. Inspect the wrapped error

When it happens

Trigger: Thrown at upup/pkg/fi/cloudup/gce/tpm/gcetpmsigner/tpmauthenticator.go:52 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/0f52d3095b78182e. Report an issue: GitHub.