kubernetes/kops · error

error reading project from GCE: %v

Error message

error reading project from GCE: %v

What it means

When GCP_PROJECT is unset, New() falls back to reading the project ID from the GCE metadata server via metadata.ProjectID(). This error wraps any failure contacting or parsing the metadata response, so the identifier cannot scope its compute queries.

Source

Thrown at pkg/nodeidentity/gce/identify.go:76

}

// New creates and returns a nodeidentity.Identifier for Nodes running on GCE
func New(clusterName string, capiManager *capimanager.Manager) (nodeidentity.Identifier, error) {
	ctx := context.Background()

	computeService, err := compute.NewService(ctx)
	if err != nil {
		return nil, fmt.Errorf("error building compute API client: %v", err)
	}

	// Project ID
	project := os.Getenv("GCP_PROJECT")
	if project != "" {
		klog.Infof("using project=%q from GCP_PROJECT env var", project)
	} else {
		project, err = metadata.ProjectID()
		if err != nil {
			return nil, fmt.Errorf("error reading project from GCE: %v", err)
		}
		project = strings.TrimSpace(project)
		if project == "" {
			return nil, fmt.Errorf("project metadata was empty")
		}
		klog.Infof("Found project=%q", project)
	}

	return &nodeIdentifier{
		computeService: computeService,
		project:        project,
		clusterName:    clusterName,
		capiManager:    capiManager,
	}, nil
}

// IdentifyNode queries GCE for the node identity information
func (i *nodeIdentifier) IdentifyNode(ctx context.Context, node *corev1.Node) (*nodeidentity.Info, error) {

View on GitHub (pinned to 4c8573c808)

Solutions

1. Set the GCP_PROJECT environment variable explicitly for the controller process/pod so the metadata lookup is skipped
2. If running on GCE, verify the metadata server (169.254.169.254) is reachable and not blocked by firewall/network policy
3. Check that the instance has a correctly attached service account (metadata requires it)
4. Fix any typo or quoting issue that makes GCP_PROJECT effectively empty

Example fix

// before
# GCP_PROJECT unset, relying on metadata server
// after
env:
- name: GCP_PROJECT
  value: my-project-id

project := os.Getenv("GCP_PROJECT")
if project == "" {
    if _, err := metadata.ProjectID(); err != nil {
        return errors.New("GCP_PROJECT unset and metadata server unreachable")
    }
}

ident, err := nodeidentitygce.New(clusterName, capiManager)
if err != nil {
    if strings.Contains(err.Error(), "error reading project from GCE") {
        // set GCP_PROJECT explicitly or fix metadata reachability, then restart
    }
}

When it happens

Trigger: GCP_PROJECT env var empty AND metadata.ProjectID() errors — controller not on GCE (no metadata server), metadata server unreachable, or credentials/metadata client misconfigured.

Common situations: Controller pod on non-GCP infrastructure without GCP_PROJECT set; network policy blocking 169.254.169.254; metadata service disabled or flaky on the instance; typo'd/empty GCP_PROJECT value falling through to the metadata path.

Related errors

• project metadata was empty
• --project cannot be empty; specify a project or omit the fla
• cannot find owner for instance %s
• ig name not set on instance template %s
• DIGITALOCEAN_ACCESS_TOKEN is required

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/cf091577d4e766df. Report an issue: GitHub.