Version 1.6. This version is no longer supported. For information about how to upgrade to version 1.7, see Upgrading Anthos on bare metal in the 1.7 documentation. For more information about supported and unsupported versions, see the Version history page in the latest documentation.
Here is a list of common errors you may encounter during Google Distributed Cloud
installation. See Known issues for more information on other
errors or limitations you might encounter with Google Distributed Cloud.
The installation process for Google Distributed Cloud is a continuous
reconciliation loop. As a result, you might see transient error messages in the
log during installation.
As long as the installation completes successfully, these errors can
be safely ignored. The following is a list of typical transient error log messages:
Get
https://127.0.0.1:34483/apis/infrastructure.baremetal.cluster.gke.io/v1/namespaces/cluster-
cluster1/baremetalmachines: dial tcp 127.0.0.1:34483: connect: connection refused"
Create Kind Cluster "msg"="apply run failed" "error"="unable to recognize \"/tmp/kout088683152\": no matches for kind \"NetworkLogging\" in version \"networking.gke.io/v1alpha1\""
Create Kind Cluster "msg"="apply run failed" "error"="unable to recognize \"/tmp/kout869681888\": no matches for kind \"Provider\" in version \"clusterctl.cluster.x-k8s.io/v1alpha3\""
If your Google Cloud service account key has expired, you will see the following
error messages from bmctl:
Error validating cluster config: 3 errors occurred:
* GKEConnect check failed: Get https://gkehub.googleapis.com/v1beta1/projects/project/locations/global/memberships/admin: oauth2: cannot fetch token: 400 Bad Request
Response: {"error":"invalid_grant","error_description":"Invalid JWT Signature."}
* ClusterOperations check failed: Post https://cloudresourcemanager.googleapis.com/v1/projects/project:testIamPermissions?alt=json&prettyPrint=false: oauth2: cannot fetch token: 400 Bad Request
Response: {"error":"invalid_grant","error_description":"Invalid JWT Signature."}
* GCR pull permission for bucket: artifacts.anthos-baremetal-release.appspot.com failed: Get https://storage.googleapis.com/storage/v1/b/artifacts.anthos-baremetal-release.appspot.com/iam/testPermissions?alt=json&permissions=storage.objects.get&permissions=storage.objects.list&prettyPrint=false: oauth2: cannot fetch token: 400 Bad Request
Response: {"error":"invalid_grant","error_description":"Invalid JWT Signature."}
[[["Easy to understand","easyToUnderstand","thumb-up"],["Solved my problem","solvedMyProblem","thumb-up"],["Other","otherUp","thumb-up"]],[["Hard to understand","hardToUnderstand","thumb-down"],["Incorrect information or sample code","incorrectInformationOrSampleCode","thumb-down"],["Missing the information/samples I need","missingTheInformationSamplesINeed","thumb-down"],["Other","otherDown","thumb-down"]],["Last updated 2025-09-04 UTC."],[[["\u003cp\u003eGoogle Distributed Cloud installations may show transient error messages in logs due to its continuous reconciliation process, which can often be ignored if the installation completes.\u003c/p\u003e\n"],["\u003cp\u003eCommon transient errors include connection refusals to webhooks and issues with cluster registration with GKE Hub, often related to temporary network or service availability issues.\u003c/p\u003e\n"],["\u003cp\u003eErrors related to "unable to recognize" specific kinds in certain versions are typical transient issues during the cluster creation process.\u003c/p\u003e\n"],["\u003cp\u003eExpired Google Cloud service account keys will result in "invalid JWT Signature" errors, which require the generation of a new service account key.\u003c/p\u003e\n"],["\u003cp\u003eFurther troubleshooting information about issues in Google Distributed Cloud is available at the provided \u003ca href=\"/anthos/clusters/docs/bare-metal/1.6/troubleshooting/known-issues\"\u003eKnown issues\u003c/a\u003e page.\u003c/p\u003e\n"]]],[],null,["# Google Distributed Cloud common error messages\n\n\u003cbr /\u003e\n\nHere is a list of common errors you may encounter during Google Distributed Cloud\ninstallation. See [Known issues](/anthos/clusters/docs/bare-metal/1.6/troubleshooting/known-issues) for more information on other\nerrors or limitations you might encounter with Google Distributed Cloud.\n\nThe installation process for Google Distributed Cloud is a continuous\nreconciliation loop. As a result, you might see transient error messages in the\nlog during installation.\n\nAs long as the installation completes successfully, these errors can\nbe safely ignored. The following is a list of typical transient error log messages: \n\n Internal error occurred: failed calling webhook \"webhook.cert-manager.io\": Post\n https://cert-manager-webhook.cert-manager.svc:443/mutate?timeout=10s:\n dial tcp IP_ADDRESS:443: connect: connection refused\n\n Internal error occurred: failed calling webhook \"vcluster.kb.io\": Post\n https://webhook-service.kube-system.svc:443/validate-baremetal-cluster-gke-io-v1-cluster?timeout=30s:\n dial tcp IP_ADDRESS:443: connect: connection refused\n\n Failed to register cluster with GKE Hub; gcloud output: error running command\n 'gcloud container fleet memberships register CLUSTER_NAME --verbosity=error --quiet':\n error: exit status 1, stderr: 'ERROR: (gcloud.container.hub.memberships.register)\n Failed to check if the user is a cluster-admin: Unable to connect to the server: EOF\n\n Get\n https://127.0.0.1:34483/apis/infrastructure.baremetal.cluster.gke.io/v1/namespaces/cluster-\n cluster1/baremetalmachines: dial tcp 127.0.0.1:34483: connect: connection refused\"\n\n Create Kind Cluster \"msg\"=\"apply run failed\" \"error\"=\"unable to recognize \\\"/tmp/kout088683152\\\": no matches for kind \\\"NetworkLogging\\\" in version \\\"networking.gke.io/v1alpha1\\\"\"\n Create Kind Cluster \"msg\"=\"apply run failed\" \"error\"=\"unable to recognize \\\"/tmp/kout869681888\\\": no matches for kind \\\"Provider\\\" in version \\\"clusterctl.cluster.x-k8s.io/v1alpha3\\\"\"\n\nIf your Google Cloud service account key has expired, you will see the following\nerror messages from `bmctl`: \n\n Error validating cluster config: 3 errors occurred:\n * GKEConnect check failed: Get https://gkehub.googleapis.com/v1beta1/projects/project/locations/global/memberships/admin: oauth2: cannot fetch token: 400 Bad Request\n Response: {\"error\":\"invalid_grant\",\"error_description\":\"Invalid JWT Signature.\"}\n * ClusterOperations check failed: Post https://cloudresourcemanager.googleapis.com/v1/projects/project:testIamPermissions?alt=json&prettyPrint=false: oauth2: cannot fetch token: 400 Bad Request\n Response: {\"error\":\"invalid_grant\",\"error_description\":\"Invalid JWT Signature.\"}\n * GCR pull permission for bucket: artifacts.anthos-baremetal-release.appspot.com failed: Get https://storage.googleapis.com/storage/v1/b/artifacts.anthos-baremetal-release.appspot.com/iam/testPermissions?alt=json&permissions=storage.objects.get&permissions=storage.objects.list&prettyPrint=false: oauth2: cannot fetch token: 400 Bad Request\n Response: {\"error\":\"invalid_grant\",\"error_description\":\"Invalid JWT Signature.\"}\n\nYou will need to generate a [new service account key](https://cloud.google.com/iam/docs/creating-managing-service-account-keys#creating_service_account_keys)."]]
