kubernetes/kops · error

instance is required

Error message

instance is required

What it means

The token must name the requesting instance so the verifier can query the Compute API and confirm the VM exists, is in the right region, and carries the cluster's metadata/labels. An empty Instance field is rejected.

Source

Thrown at upup/pkg/fi/cloudup/gce/tpm/gcetpmverifier/tpmverifier.go:121

	if timeSkew > float64(v.opt.MaxTimeSkew) {
		return nil, fmt.Errorf("incorrect Timestamp %v", tokenData.Timestamp)
	}

	// Verify the token has signed the body content.
	requestHash := sha256.Sum256(body)
	if !bytes.Equal(requestHash[:], tokenData.RequestHash) {
		return nil, fmt.Errorf("incorrect RequestHash")
	}

	// Some basic validation to avoid requesting invalid instances.
	if tokenData.GCPProjectID == "" {
		return nil, fmt.Errorf("gcpProjectID is required")
	}
	if tokenData.Zone == "" {
		return nil, fmt.Errorf("zone is required")
	}
	if tokenData.Instance == "" {
		return nil, fmt.Errorf("instance is required")
	}

	// Verify node is in our cluster
	if tokenData.GCPProjectID != v.opt.ProjectID {
		return nil, fmt.Errorf("projectID does not match expected: got %q, want %q", tokenData.GCPProjectID, v.opt.ProjectID)
	}

	instance, err := v.computeClient.Instances.Get(tokenData.GCPProjectID, tokenData.Zone, tokenData.Instance).Context(ctx).Do()
	if err != nil {
		if isNotFound(err) {
			return nil, fmt.Errorf("unable to find instance in compute API: %w", err)
		}
		return nil, fmt.Errorf("error fetching instance from compute API: %w", err)
	}

	if !strings.HasPrefix(lastComponent(instance.Zone), v.opt.Region+"-") {
		return nil, fmt.Errorf("instance was in zone %q, expected region %q", instance.Zone, v.opt.Region)
	}

View on GitHub (pinned to 4c8573c808)

Solutions

1. Populate the instance name claim from GCE instance metadata when minting the token.
2. Align the client token schema with the verifier's TokenData struct.
3. Regenerate the node's token after fixing the producer; restart the node service if it caches tokens.

Example fix

// before
tokenData := gcetpm.TokenData{GCPProjectID: projectID, Zone: zone}
// after
name, _ := metadata.InstanceName()
tokenData := gcetpm.TokenData{GCPProjectID: projectID, Zone: zone, Instance: name}

if tokenData.Instance == "" {
	return fmt.Errorf("token missing instance name; read it from instance/name metadata")
}

When it happens

Trigger: VerifyToken receives a token whose tokenData.Instance field is empty.

Common situations: Token producer failed to read the instance name from metadata (`instance/name`), client built before the Instance claim existed, or test tokens constructed without it.

Understand the failure class

Background: "missing required argument" and "the following required arguments were not provided": what required-argument errors mean and how to fix them — this error's family across 20 libraries.

Related errors

• gcpProjectID is required
• zone is required
• failed to get GCE RSA attestation key from TPM: %w
• failed to sign token data: %w
• incorrect Timestamp %v

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/cd0cbf68edfa1ab7. Report an issue: GitHub.