Version 1.13. This version is no longer supported. For information about how to upgrade to version 1.14, see Upgrading Anthos on bare metal in the 1.14 documentation. For more information about supported and unsupported versions, see the Version history page in the latest documentation.
Here is a list of common errors you may encounter during Google Distributed Cloud
installation. See Known issues for more information on other
errors or limitations you might encounter with Google Distributed Cloud.
The installation process for Google Distributed Cloud is a continuous
reconciliation loop. As a result, you might see transient error messages in the
log during installation.
As long as the installation completes successfully, these errors can
be safely ignored. The following is a list of typical transient error log messages:
Failed to register cluster with GKE Hub; gcloud output: error running command
'gcloud container fleet memberships register CLUSTER_NAME --verbosity=error --quiet':
error: exit status 1, stderr: 'ERROR: (gcloud.container.hub.memberships.register)
Failed to check if the user is a cluster-admin: Unable to connect to the server: EOF
Get
https://127.0.0.1:34483/apis/infrastructure.baremetal.cluster.gke.io/v1/namespaces/cluster-
cluster1/baremetalmachines: dial tcp 127.0.0.1:34483: connect: connection refused"
Create Kind Cluster "msg"="apply run failed" "error"="unable to recognize \"/tmp/kout088683152\": no matches for kind \"NetworkLogging\" in version \"networking.gke.io/v1alpha1\""
Create Kind Cluster "msg"="apply run failed" "error"="unable to recognize \"/tmp/kout869681888\": no matches for kind \"Provider\" in version \"clusterctl.cluster.x-k8s.io/v1alpha3\""
If your Google Cloud service account key has expired, you will see the following
error messages from bmctl:
Error validating cluster config: 3 errors occurred:
* GKEConnect check failed: Get https://gkehub.googleapis.com/v1beta1/projects/project/locations/global/memberships/admin: oauth2: cannot fetch token: 400 Bad Request
Response: {"error":"invalid_grant","error_description":"Invalid JWT Signature."}
* ClusterOperations check failed: Post https://cloudresourcemanager.googleapis.com/v1/projects/project:testIamPermissions?alt=json&prettyPrint=false: oauth2: cannot fetch token: 400 Bad Request
Response: {"error":"invalid_grant","error_description":"Invalid JWT Signature."}
* GCR pull permission for bucket: artifacts.anthos-baremetal-release.appspot.com failed: Get https://storage.googleapis.com/storage/v1/b/artifacts.anthos-baremetal-release.appspot.com/iam/testPermissions?alt=json&permissions=storage.objects.get&permissions=storage.objects.list&prettyPrint=false: oauth2: cannot fetch token: 400 Bad Request
Response: {"error":"invalid_grant","error_description":"Invalid JWT Signature."}
[[["Easy to understand","easyToUnderstand","thumb-up"],["Solved my problem","solvedMyProblem","thumb-up"],["Other","otherUp","thumb-up"]],[["Hard to understand","hardToUnderstand","thumb-down"],["Incorrect information or sample code","incorrectInformationOrSampleCode","thumb-down"],["Missing the information/samples I need","missingTheInformationSamplesINeed","thumb-down"],["Other","otherDown","thumb-down"]],["Last updated 2025-09-04 UTC."],[[["\u003cp\u003eGoogle Distributed Cloud installations involve a continuous reconciliation loop, which may result in transient error messages in the logs during installation.\u003c/p\u003e\n"],["\u003cp\u003eTransient error messages, such as connection refusals to webhooks or issues registering with GKE Hub, can generally be ignored if the installation completes successfully.\u003c/p\u003e\n"],["\u003cp\u003eExpired Google Cloud service account keys can lead to "invalid JWT Signature" errors, requiring the generation of a new service account key.\u003c/p\u003e\n"],["\u003cp\u003eIf you see "no matches for kind" error messages, those are errors that may be encountered during the installation.\u003c/p\u003e\n"]]],[],null,["# Google Distributed Cloud common error messages\n\n\u003cbr /\u003e\n\nHere is a list of common errors you may encounter during Google Distributed Cloud\ninstallation. See [Known issues](/anthos/clusters/docs/bare-metal/1.13/troubleshooting/known-issues) for more information on other\nerrors or limitations you might encounter with Google Distributed Cloud.\n\nThe installation process for Google Distributed Cloud is a continuous\nreconciliation loop. As a result, you might see transient error messages in the\nlog during installation.\n\nAs long as the installation completes successfully, these errors can\nbe safely ignored. The following is a list of typical transient error log messages: \n\n Internal error occurred: failed calling webhook \"webhook.cert-manager.io\": Post\n https://cert-manager-webhook.cert-manager.svc:443/mutate?timeout=10s:\n dial tcp IP_ADDRESS:443: connect: connection refused\n\n Internal error occurred: failed calling webhook \"vcluster.kb.io\": Post\n https://webhook-service.kube-system.svc:443/validate-baremetal-cluster-gke-io-v1-cluster?timeout=30s:\n dial tcp IP_ADDRESS:443: connect: connection refused\n\n Failed to register cluster with GKE Hub; gcloud output: error running command\n 'gcloud container fleet memberships register CLUSTER_NAME --verbosity=error --quiet':\n error: exit status 1, stderr: 'ERROR: (gcloud.container.hub.memberships.register)\n Failed to check if the user is a cluster-admin: Unable to connect to the server: EOF\n\n Get\n https://127.0.0.1:34483/apis/infrastructure.baremetal.cluster.gke.io/v1/namespaces/cluster-\n cluster1/baremetalmachines: dial tcp 127.0.0.1:34483: connect: connection refused\"\n\n Create Kind Cluster \"msg\"=\"apply run failed\" \"error\"=\"unable to recognize \\\"/tmp/kout088683152\\\": no matches for kind \\\"NetworkLogging\\\" in version \\\"networking.gke.io/v1alpha1\\\"\"\n Create Kind Cluster \"msg\"=\"apply run failed\" \"error\"=\"unable to recognize \\\"/tmp/kout869681888\\\": no matches for kind \\\"Provider\\\" in version \\\"clusterctl.cluster.x-k8s.io/v1alpha3\\\"\"\n\nIf your Google Cloud service account key has expired, you will see the following\nerror messages from `bmctl`: \n\n Error validating cluster config: 3 errors occurred:\n * GKEConnect check failed: Get https://gkehub.googleapis.com/v1beta1/projects/project/locations/global/memberships/admin: oauth2: cannot fetch token: 400 Bad Request\n Response: {\"error\":\"invalid_grant\",\"error_description\":\"Invalid JWT Signature.\"}\n * ClusterOperations check failed: Post https://cloudresourcemanager.googleapis.com/v1/projects/project:testIamPermissions?alt=json&prettyPrint=false: oauth2: cannot fetch token: 400 Bad Request\n Response: {\"error\":\"invalid_grant\",\"error_description\":\"Invalid JWT Signature.\"}\n * GCR pull permission for bucket: artifacts.anthos-baremetal-release.appspot.com failed: Get https://storage.googleapis.com/storage/v1/b/artifacts.anthos-baremetal-release.appspot.com/iam/testPermissions?alt=json&permissions=storage.objects.get&permissions=storage.objects.list&prettyPrint=false: oauth2: cannot fetch token: 400 Bad Request\n Response: {\"error\":\"invalid_grant\",\"error_description\":\"Invalid JWT Signature.\"}\n\nYou will need to generate a [new service account key](https://cloud.google.com/iam/docs/creating-managing-service-account-keys#creating_service_account_keys)."]]
