kubernetes/kops · error

unable to find instance in compute API: %w

Error message

unable to find instance in compute API: %w

What it means

The verifier wraps a googleapi NotFound error (HTTP 404) from computeClient.Instances.Get: the VM named in the token does not exist in the given project/zone. This prevents deleted or fabricated instance identities from authenticating.

Source

Thrown at upup/pkg/fi/cloudup/gce/tpm/gcetpmverifier/tpmverifier.go:132

	if tokenData.GCPProjectID == "" {
		return nil, fmt.Errorf("gcpProjectID is required")
	}
	if tokenData.Zone == "" {
		return nil, fmt.Errorf("zone is required")
	}
	if tokenData.Instance == "" {
		return nil, fmt.Errorf("instance is required")
	}

	// Verify node is in our cluster
	if tokenData.GCPProjectID != v.opt.ProjectID {
		return nil, fmt.Errorf("projectID does not match expected: got %q, want %q", tokenData.GCPProjectID, v.opt.ProjectID)
	}

	instance, err := v.computeClient.Instances.Get(tokenData.GCPProjectID, tokenData.Zone, tokenData.Instance).Context(ctx).Do()
	if err != nil {
		if isNotFound(err) {
			return nil, fmt.Errorf("unable to find instance in compute API: %w", err)
		}
		return nil, fmt.Errorf("error fetching instance from compute API: %w", err)
	}

	if !strings.HasPrefix(lastComponent(instance.Zone), v.opt.Region+"-") {
		return nil, fmt.Errorf("instance was in zone %q, expected region %q", instance.Zone, v.opt.Region)
	}

	clusterName := ""
	instanceGroupName := ""
	for _, item := range instance.Metadata.Items {
		switch item.Key {
		case gce.MetadataKeyInstanceGroupName:
			instanceGroupName = fi.ValueOf(item.Value)
		case gcemetadata.MetadataKeyClusterName:
			clusterName = fi.ValueOf(item.Value)
		}
	}

View on GitHub (pinned to 4c8573c808)

Solutions

1. Verify the instance exists: `gcloud compute instances describe <name> --zone <zone> --project <project>`.
2. Regenerate the token on the (recreated) node so it carries the current instance name and zone.
3. Check the token producer reads the correct `instance/name` and `instance/zone` metadata values.

_, err := computeClient.Instances.Get(project, zone, instance).Context(ctx).Do()
if err != nil {
	return fmt.Errorf("instance %s/%s not found before requesting token: %w", zone, instance, err)
}

var notFound *googleapi.Error
if errors.As(err, &notFound) && notFound.Code == 404 {
	// regenerate token / re-provision node
}

When it happens

Trigger: Instances.Get(project, zone, instance) returns 404 — the instance was deleted, never existed, or the token names the wrong zone/instance combination.

Common situations: Node deleted/recreated (new VM name) while presenting an old token, tokens minted with partial zone paths or wrong zone, stale node records after cluster resize, or cross-region typos in configuration.

Understand the failure class

Background: 'Could not be found', 'does not exist', 'not found in database': the resource-not-found family when an ID, slug, key, or URI lookup comes back empty — this error's family across 20 libraries.

Related errors

• error listing zones: %v
• incorrect Timestamp %v
• incorrect RequestHash
• error fetching instance from compute API: %w
• DIGITALOCEAN_ACCESS_TOKEN is required

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/1a1bec4ed2107abb. Report an issue: GitHub.