kubernetes/kops · error

missing instance id: %s

Error message

missing instance id: %s

What it means

The EC2 DescribeInstances call succeeded but returned no reservations or no instances, meaning the instance ID taken from the assumed-role session name does not correspond to a live EC2 instance visible to this account/region. kOps requires an exact single-instance match to derive the node's certificate names and challenge endpoints.

Source

Thrown at pkg/bootstrap/awsbootstrap/verifier.go:302

		if resource[1] == role {
			found = true
			break
		}
	}
	if !found {
		return nil, fmt.Errorf("arn %q does not contain acceptable node role", arn)
	}

	instanceID := resource[2]
	instances, err := a.ec2.DescribeInstances(ctx, &ec2.DescribeInstancesInput{
		InstanceIds: []string{instanceID},
	})
	if err != nil {
		return nil, fmt.Errorf("describing instance for arn %q", arn)
	}

	if len(instances.Reservations) <= 0 || len(instances.Reservations[0].Instances) <= 0 {
		return nil, fmt.Errorf("missing instance id: %s", instanceID)
	}
	if len(instances.Reservations[0].Instances) > 1 {
		return nil, fmt.Errorf("found multiple instances with instance id: %s", instanceID)
	}

	instance := instances.Reservations[0].Instances[0]

	addrs, err := GetInstanceCertificateNames(instances)
	if err != nil {
		return nil, err
	}

	var challengeEndpoints []string
	for _, nic := range instance.NetworkInterfaces {
		if ip := aws.ToString(nic.PrivateIpAddress); ip != "" {
			challengeEndpoints = append(challengeEndpoints, net.JoinHostPort(ip, strconv.Itoa(wellknownports.NodeupChallenge)))
		}
		for _, a := range nic.PrivateIpAddresses {

View on GitHub (pinned to 4c8573c808)

Solutions

1. Confirm the instance ID in the ARN session segment exists: aws ec2 describe-instances --instance-ids i-xxx in the same region/account as the API server.
2. Ensure nodeup uses the IMDS-provided credentials so the session name is the actual instance ID, not an arbitrary string.
3. Rebootstrap the node with fresh credentials if the original instance was terminated and replaced.
4. Verify the API server is operating in the same region as the cluster's instances (KOPS_REGION / cluster spec region).

Example fix

// before: sts assume-role with non-instance session name
--role-session-name deploy-test
// after
--role-session-name $(INSTANCE_ID)  // from IMDS, matching a live EC2 instance

out, err := ec2Client.DescribeInstances(ctx, &ec2.DescribeInstancesInput{InstanceIds: []string{instanceID}})
if err != nil || len(out.Reservations) == 0 || len(out.Reservations[0].Instances) == 0 {
    return fmt.Errorf("instance %s not found in region %s/account %s; confirm it exists and is running", instanceID, region, account)
}

func instanceExists(reservations []types.Reservation) bool {
	for _, r := range reservations {
		if len(r.Instances) > 0 {
			return true
		}
	}
	return false
}

if err == nil && (len(instances.Reservations) == 0 || len(instances.Reservations[0].Instances) == 0) {
	return nil, fmt.Errorf("missing instance id: %s (check region %s and that the instance is running)", instanceID, region)
}

When it happens

Trigger: verifyCallerIdentity queries DescribeInstances with the ID parsed from resource[2] and gets zero results — the session name was not a real instance ID, the instance was terminated, or the instance lives in another account/region than the one the verifier queries.

Common situations: AssumeRole called with RoleSessionName that isn't an instance ID (e.g. "build-session"); instance terminated between credential minting and verification; multi-region or cross-account confusion (instance in another region's EC2 endpoint); stale credentials reused after instance replacement in an autoscaling group.

Related errors

• failed to get region from ec2 metadata: %w
• found multiple instances with instance id: %s
• cannot determine challenge endpoint for instance id: %s
• too many reservations returned for the single instance-id
• too many instances returned for the single instance-id

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/2df9641bd5f681a2. Report an issue: GitHub.