Version 1.15. This version is no longer supported. For information about how to upgrade to version 1.16, see Upgrade clusters in the latest documentation. For more information about supported and unsupported versions, see the Version history page in the latest documentation.
Here is a list of common errors you may encounter during Google Distributed Cloud
installation. See Known issues for more information on other
errors or limitations you might encounter with Google Distributed Cloud.
The installation process for Google Distributed Cloud is a continuous
reconciliation loop. As a result, you might see transient error messages in the
log during installation.
As long as the installation completes successfully, these errors can
be safely ignored. The following is a list of typical transient error log messages:
Failed to register cluster with GKE Hub; gcloud output: error running command
'gcloud container fleet memberships register CLUSTER_NAME --verbosity=error --quiet':
error: exit status 1, stderr: 'ERROR: (gcloud.container.hub.memberships.register)
Failed to check if the user is a cluster-admin: Unable to connect to the server: EOF
Get
https://127.0.0.1:34483/apis/infrastructure.baremetal.cluster.gke.io/v1/namespaces/cluster-
cluster1/baremetalmachines: dial tcp 127.0.0.1:34483: connect: connection refused"
Create Kind Cluster "msg"="apply run failed" "error"="unable to recognize \"/tmp/kout088683152\": no matches for kind \"NetworkLogging\" in version \"networking.gke.io/v1alpha1\""
Create Kind Cluster "msg"="apply run failed" "error"="unable to recognize \"/tmp/kout869681888\": no matches for kind \"Provider\" in version \"clusterctl.cluster.x-k8s.io/v1alpha3\""
If your Google Cloud service account key has expired, you will see the following
error messages from bmctl:
Error validating cluster config: 3 errors occurred:
* GKEConnect check failed: Get https://gkehub.googleapis.com/v1beta1/projects/project/locations/global/memberships/admin: oauth2: cannot fetch token: 400 Bad Request
Response: {"error":"invalid_grant","error_description":"Invalid JWT Signature."}
* ClusterOperations check failed: Post https://cloudresourcemanager.googleapis.com/v1/projects/project:testIamPermissions?alt=json&prettyPrint=false: oauth2: cannot fetch token: 400 Bad Request
Response: {"error":"invalid_grant","error_description":"Invalid JWT Signature."}
* GCR pull permission for bucket: artifacts.anthos-baremetal-release.appspot.com failed: Get https://storage.googleapis.com/storage/v1/b/artifacts.anthos-baremetal-release.appspot.com/iam/testPermissions?alt=json&permissions=storage.objects.get&permissions=storage.objects.list&prettyPrint=false: oauth2: cannot fetch token: 400 Bad Request
Response: {"error":"invalid_grant","error_description":"Invalid JWT Signature."}
[[["Easy to understand","easyToUnderstand","thumb-up"],["Solved my problem","solvedMyProblem","thumb-up"],["Other","otherUp","thumb-up"]],[["Hard to understand","hardToUnderstand","thumb-down"],["Incorrect information or sample code","incorrectInformationOrSampleCode","thumb-down"],["Missing the information/samples I need","missingTheInformationSamplesINeed","thumb-down"],["Other","otherDown","thumb-down"]],["Last updated 2025-09-09 UTC."],[[["\u003cp\u003eGoogle Distributed Cloud installations involve a continuous reconciliation loop, which may result in transient error messages in the logs.\u003c/p\u003e\n"],["\u003cp\u003eTransient errors during the installation process can typically be ignored, provided the overall installation completes successfully.\u003c/p\u003e\n"],["\u003cp\u003eCommon transient errors include issues with webhooks, cluster registration with GKE Hub, and connection refusals to internal addresses.\u003c/p\u003e\n"],["\u003cp\u003eExpired Google Cloud service account keys will lead to \u003ccode\u003ebmctl\u003c/code\u003e errors, primarily related to failed token fetches and JWT signature invalidation.\u003c/p\u003e\n"],["\u003cp\u003eIf service account key expiration errors occur, a new service account key needs to be generated to resolve the issue.\u003c/p\u003e\n"]]],[],null,["# Google Distributed Cloud common error messages\n\n\u003cbr /\u003e\n\nHere is a list of common errors you may encounter during Google Distributed Cloud\ninstallation. See [Known issues](/anthos/clusters/docs/bare-metal/1.15/troubleshooting/known-issues) for more information on other\nerrors or limitations you might encounter with Google Distributed Cloud.\n\nThe installation process for Google Distributed Cloud is a continuous\nreconciliation loop. As a result, you might see transient error messages in the\nlog during installation.\n\nAs long as the installation completes successfully, these errors can\nbe safely ignored. The following is a list of typical transient error log messages: \n\n Internal error occurred: failed calling webhook \"webhook.cert-manager.io\": Post\n https://cert-manager-webhook.cert-manager.svc:443/mutate?timeout=10s:\n dial tcp IP_ADDRESS:443: connect: connection refused\n\n Internal error occurred: failed calling webhook \"vcluster.kb.io\": Post\n https://webhook-service.kube-system.svc:443/validate-baremetal-cluster-gke-io-v1-cluster?timeout=30s:\n dial tcp IP_ADDRESS:443: connect: connection refused\n\n Failed to register cluster with GKE Hub; gcloud output: error running command\n 'gcloud container fleet memberships register CLUSTER_NAME --verbosity=error --quiet':\n error: exit status 1, stderr: 'ERROR: (gcloud.container.hub.memberships.register)\n Failed to check if the user is a cluster-admin: Unable to connect to the server: EOF\n\n Get\n https://127.0.0.1:34483/apis/infrastructure.baremetal.cluster.gke.io/v1/namespaces/cluster-\n cluster1/baremetalmachines: dial tcp 127.0.0.1:34483: connect: connection refused\"\n\n Create Kind Cluster \"msg\"=\"apply run failed\" \"error\"=\"unable to recognize \\\"/tmp/kout088683152\\\": no matches for kind \\\"NetworkLogging\\\" in version \\\"networking.gke.io/v1alpha1\\\"\"\n Create Kind Cluster \"msg\"=\"apply run failed\" \"error\"=\"unable to recognize \\\"/tmp/kout869681888\\\": no matches for kind \\\"Provider\\\" in version \\\"clusterctl.cluster.x-k8s.io/v1alpha3\\\"\"\n\nIf your Google Cloud service account key has expired, you will see the following\nerror messages from `bmctl`: \n\n Error validating cluster config: 3 errors occurred:\n * GKEConnect check failed: Get https://gkehub.googleapis.com/v1beta1/projects/project/locations/global/memberships/admin: oauth2: cannot fetch token: 400 Bad Request\n Response: {\"error\":\"invalid_grant\",\"error_description\":\"Invalid JWT Signature.\"}\n * ClusterOperations check failed: Post https://cloudresourcemanager.googleapis.com/v1/projects/project:testIamPermissions?alt=json&prettyPrint=false: oauth2: cannot fetch token: 400 Bad Request\n Response: {\"error\":\"invalid_grant\",\"error_description\":\"Invalid JWT Signature.\"}\n * GCR pull permission for bucket: artifacts.anthos-baremetal-release.appspot.com failed: Get https://storage.googleapis.com/storage/v1/b/artifacts.anthos-baremetal-release.appspot.com/iam/testPermissions?alt=json&permissions=storage.objects.get&permissions=storage.objects.list&prettyPrint=false: oauth2: cannot fetch token: 400 Bad Request\n Response: {\"error\":\"invalid_grant\",\"error_description\":\"Invalid JWT Signature.\"}\n\nYou will need to generate a [new service account key](https://cloud.google.com/iam/docs/creating-managing-service-account-keys#creating_service_account_keys)."]]
