kubernetes/kops · error

zone is required

Error message

zone is required

What it means

The token must specify the GCE zone of the requesting instance; the verifier needs it to fetch the instance from the Compute API and validate its region. An empty Zone in the token payload is rejected.

Source

Thrown at upup/pkg/fi/cloudup/gce/tpm/gcetpmverifier/tpmverifier.go:118

		return nil, fmt.Errorf("incorrect Audience")
	}
	timeSkew := math.Abs(time.Since(time.Unix(tokenData.Timestamp, 0)).Seconds())
	if timeSkew > float64(v.opt.MaxTimeSkew) {
		return nil, fmt.Errorf("incorrect Timestamp %v", tokenData.Timestamp)
	}

	// Verify the token has signed the body content.
	requestHash := sha256.Sum256(body)
	if !bytes.Equal(requestHash[:], tokenData.RequestHash) {
		return nil, fmt.Errorf("incorrect RequestHash")
	}

	// Some basic validation to avoid requesting invalid instances.
	if tokenData.GCPProjectID == "" {
		return nil, fmt.Errorf("gcpProjectID is required")
	}
	if tokenData.Zone == "" {
		return nil, fmt.Errorf("zone is required")
	}
	if tokenData.Instance == "" {
		return nil, fmt.Errorf("instance is required")
	}

	// Verify node is in our cluster
	if tokenData.GCPProjectID != v.opt.ProjectID {
		return nil, fmt.Errorf("projectID does not match expected: got %q, want %q", tokenData.GCPProjectID, v.opt.ProjectID)
	}

	instance, err := v.computeClient.Instances.Get(tokenData.GCPProjectID, tokenData.Zone, tokenData.Instance).Context(ctx).Do()
	if err != nil {
		if isNotFound(err) {
			return nil, fmt.Errorf("unable to find instance in compute API: %w", err)
		}
		return nil, fmt.Errorf("error fetching instance from compute API: %w", err)
	}

View on GitHub (pinned to 4c8573c808)

Solutions

1. Populate the zone claim from GCE instance metadata when minting the token.
2. Ensure the client token schema matches the verifier's expected fields.
3. Use the full zone path or zone name consistently with what Instances.Get expects.

Example fix

// before
tokenData := gcetpm.TokenData{GCPProjectID: projectID, Instance: instance}
// after
zone := metadata.Zone() // e.g. us-central1-a
tokenData := gcetpm.TokenData{GCPProjectID: projectID, Zone: zone, Instance: instance}

if tokenData.Zone == "" {
	return fmt.Errorf("token missing zone; read it from instance/zone metadata")
}

When it happens

Trigger: VerifyToken receives a token whose tokenData.Zone field is empty.

Common situations: Token producer failed to read the zone from instance metadata (`instance/zone`), older client version not populating the field, or hand-crafted test tokens missing the claim.

Understand the failure class

Background: "missing required argument" and "the following required arguments were not provided": what required-argument errors mean and how to fix them — this error's family across 20 libraries.

Related errors

• gcpProjectID is required
• instance is required
• failed to get GCE RSA attestation key from TPM: %w
• failed to sign token data: %w
• incorrect Timestamp %v

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/f700680415c44783. Report an issue: GitHub.