kubernetes/kops · error

gcpProjectID is required

Error message

gcpProjectID is required

What it means

The signed token must identify the GCP project of the requesting instance so the verifier can look it up and validate it belongs to the cluster. An empty GCPProjectID in the token payload fails this basic validation.

Source

Thrown at upup/pkg/fi/cloudup/gce/tpm/gcetpmverifier/tpmverifier.go:115

	// Guard against replay attacks
	if tokenData.Audience != gcetpm.AudienceNodeAuthentication {
		return nil, fmt.Errorf("incorrect Audience")
	}
	timeSkew := math.Abs(time.Since(time.Unix(tokenData.Timestamp, 0)).Seconds())
	if timeSkew > float64(v.opt.MaxTimeSkew) {
		return nil, fmt.Errorf("incorrect Timestamp %v", tokenData.Timestamp)
	}

	// Verify the token has signed the body content.
	requestHash := sha256.Sum256(body)
	if !bytes.Equal(requestHash[:], tokenData.RequestHash) {
		return nil, fmt.Errorf("incorrect RequestHash")
	}

	// Some basic validation to avoid requesting invalid instances.
	if tokenData.GCPProjectID == "" {
		return nil, fmt.Errorf("gcpProjectID is required")
	}
	if tokenData.Zone == "" {
		return nil, fmt.Errorf("zone is required")
	}
	if tokenData.Instance == "" {
		return nil, fmt.Errorf("instance is required")
	}

	// Verify node is in our cluster
	if tokenData.GCPProjectID != v.opt.ProjectID {
		return nil, fmt.Errorf("projectID does not match expected: got %q, want %q", tokenData.GCPProjectID, v.opt.ProjectID)
	}

	instance, err := v.computeClient.Instances.Get(tokenData.GCPProjectID, tokenData.Zone, tokenData.Instance).Context(ctx).Do()
	if err != nil {
		if isNotFound(err) {
			return nil, fmt.Errorf("unable to find instance in compute API: %w", err)
		}

View on GitHub (pinned to 4c8573c808)

Solutions

1. Fix the client to include the GCP project ID (e.g. from instance metadata `project/project-id`) when constructing the token.
2. Verify client and server share the same token struct/schema and JSON field names.
3. Check the token producer version matches what the verifier expects; upgrade the node component if the claim is missing due to a version mismatch.

Example fix

// before
tokenData := gcetpm.TokenData{Zone: zone, Instance: instance}
// after
tokenData := gcetpm.TokenData{GCPProjectID: projectID, Zone: zone, Instance: instance}

if tokenData.GCPProjectID == "" {
	return fmt.Errorf("token missing GCPProjectID; client must set it from instance metadata")
}

When it happens

Trigger: VerifyToken receives a token whose tokenData.GCPProjectID field is the empty string.

Common situations: A token producer that omits the project claim when minting the token, a client built against a different/older token schema that doesn't populate GCPProjectID, or manual/crafted token generation for testing.

Understand the failure class

Background: "missing required argument" and "the following required arguments were not provided": what required-argument errors mean and how to fix them — this error's family across 20 libraries.

Related errors

• zone is required
• instance is required
• failed to get GCE RSA attestation key from TPM: %w
• failed to sign token data: %w
• incorrect Timestamp %v

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/c7609f4606f289ed. Report an issue: GitHub.