kubernetes/kops · error

project metadata was empty

Error message

project metadata was empty

What it means

metadata.ProjectID() succeeded but returned an empty string (even after trimming whitespace). Without a project ID the GCE node identifier cannot query instances, so New() refuses to start rather than produce a broken identifier.

Source

Thrown at pkg/nodeidentity/gce/identify.go:80

	ctx := context.Background()

	computeService, err := compute.NewService(ctx)
	if err != nil {
		return nil, fmt.Errorf("error building compute API client: %v", err)
	}

	// Project ID
	project := os.Getenv("GCP_PROJECT")
	if project != "" {
		klog.Infof("using project=%q from GCP_PROJECT env var", project)
	} else {
		project, err = metadata.ProjectID()
		if err != nil {
			return nil, fmt.Errorf("error reading project from GCE: %v", err)
		}
		project = strings.TrimSpace(project)
		if project == "" {
			return nil, fmt.Errorf("project metadata was empty")
		}
		klog.Infof("Found project=%q", project)
	}

	return &nodeIdentifier{
		computeService: computeService,
		project:        project,
		clusterName:    clusterName,
		capiManager:    capiManager,
	}, nil
}

// IdentifyNode queries GCE for the node identity information
func (i *nodeIdentifier) IdentifyNode(ctx context.Context, node *corev1.Node) (*nodeidentity.Info, error) {
	// log := klog.FromContext(ctx)

	providerID := node.Spec.ProviderID
	if providerID == "" {

View on GitHub (pinned to 4c8573c808)

Solutions

1. Set the GCP_PROJECT environment variable explicitly to bypass the metadata lookup
2. Restart the instance or retry if the metadata service returned an anomalous empty response
3. Verify the VM is actually associated with a valid GCP project in the console
4. Check whether any proxy/sidecar intercepts metadata requests and returns empty bodies

Example fix

// before
# GCP_PROJECT unset
// after
GCP_PROJECT=my-project-id kops-controller ...

project := strings.TrimSpace(os.Getenv("GCP_PROJECT"))
if project == "" {
    p, err := metadata.ProjectID()
    if err != nil || strings.TrimSpace(p) == "" {
        return errors.New("could not determine GCP project")
    }
}

ident, err := nodeidentitygce.New(clusterName, capiManager)
if err != nil {
    if strings.Contains(err.Error(), "project metadata was empty") {
        // set GCP_PROJECT env var and restart the controller
    }
}

When it happens

Trigger: The GCE metadata server responds 200 with an empty project ID body while GCP_PROJECT is unset — rare, typically a metadata service anomaly or an instance without a resolvable project context.

Common situations: Degenerate metadata responses on oddly configured instances; mocking/proxying of the metadata endpoint returning empty payloads; project association issues on the VM.

Related errors

• error reading project from GCE: %v
• cannot find owner for instance %s
• ig name not set on instance template %s
• instance %s from Akamai (Linode) metadata was empty
• error building node identifier: %w

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/d87c3e3bae8ab8be. Report an issue: GitHub.