Version 1.8. This version is no longer supported. For information about how to upgrade to version 1.9, see Upgrading Anthos on bare metal in the 1.9 documentation. For more information about supported and unsupported versions, see the Version history page in the latest documentation.
Here is a list of common errors you may encounter during Google Distributed Cloud
installation. See Known issues for more information on other
errors or limitations you might encounter with Google Distributed Cloud.
The installation process for Google Distributed Cloud is a continuous
reconciliation loop. As a result, you might see transient error messages in the
log during installation.
As long as the installation completes successfully, these errors can
be safely ignored. The following is a list of typical transient error log messages:
Failed to register cluster with GKE Hub; gcloud output: error running command
'gcloud container fleet memberships register CLUSTER_NAME --verbosity=error --quiet':
error: exit status 1, stderr: 'ERROR: (gcloud.container.hub.memberships.register)
Failed to check if the user is a cluster-admin: Unable to connect to the server: EOF
Get
https://127.0.0.1:34483/apis/infrastructure.baremetal.cluster.gke.io/v1/namespaces/cluster-
cluster1/baremetalmachines: dial tcp 127.0.0.1:34483: connect: connection refused"
Create Kind Cluster "msg"="apply run failed" "error"="unable to recognize \"/tmp/kout088683152\": no matches for kind \"NetworkLogging\" in version \"networking.gke.io/v1alpha1\""
Create Kind Cluster "msg"="apply run failed" "error"="unable to recognize \"/tmp/kout869681888\": no matches for kind \"Provider\" in version \"clusterctl.cluster.x-k8s.io/v1alpha3\""
If your Google Cloud service account key has expired, you will see the following
error messages from bmctl:
Error validating cluster config: 3 errors occurred:
* GKEConnect check failed: Get https://gkehub.googleapis.com/v1beta1/projects/project/locations/global/memberships/admin: oauth2: cannot fetch token: 400 Bad Request
Response: {"error":"invalid_grant","error_description":"Invalid JWT Signature."}
* ClusterOperations check failed: Post https://cloudresourcemanager.googleapis.com/v1/projects/project:testIamPermissions?alt=json&prettyPrint=false: oauth2: cannot fetch token: 400 Bad Request
Response: {"error":"invalid_grant","error_description":"Invalid JWT Signature."}
* GCR pull permission for bucket: artifacts.anthos-baremetal-release.appspot.com failed: Get https://storage.googleapis.com/storage/v1/b/artifacts.anthos-baremetal-release.appspot.com/iam/testPermissions?alt=json&permissions=storage.objects.get&permissions=storage.objects.list&prettyPrint=false: oauth2: cannot fetch token: 400 Bad Request
Response: {"error":"invalid_grant","error_description":"Invalid JWT Signature."}
[[["Easy to understand","easyToUnderstand","thumb-up"],["Solved my problem","solvedMyProblem","thumb-up"],["Other","otherUp","thumb-up"]],[["Hard to understand","hardToUnderstand","thumb-down"],["Incorrect information or sample code","incorrectInformationOrSampleCode","thumb-down"],["Missing the information/samples I need","missingTheInformationSamplesINeed","thumb-down"],["Other","otherDown","thumb-down"]],["Last updated 2025-09-04 UTC."],[[["\u003cp\u003eTransient error messages during Google Distributed Cloud installation are common due to the continuous reconciliation loop, and they can usually be ignored if the installation completes successfully.\u003c/p\u003e\n"],["\u003cp\u003eCommon transient errors include connection refused messages related to webhooks, GKE Hub registration failures, and issues with recognizing certain kinds of resources.\u003c/p\u003e\n"],["\u003cp\u003eExpired Google Cloud service account keys will result in "invalid JWT Signature" errors during validation and require generating a new service account key.\u003c/p\u003e\n"],["\u003cp\u003eInstallation logs may include messages about failing to connect to servers or webhooks, such as \u003ccode\u003econnection refused\u003c/code\u003e errors with IP addresses, which can be safe to ignore if installation is successful.\u003c/p\u003e\n"]]],[],null,["# Google Distributed Cloud common error messages\n\n\u003cbr /\u003e\n\nHere is a list of common errors you may encounter during Google Distributed Cloud\ninstallation. See [Known issues](/anthos/clusters/docs/bare-metal/1.8/troubleshooting/known-issues) for more information on other\nerrors or limitations you might encounter with Google Distributed Cloud.\n\nThe installation process for Google Distributed Cloud is a continuous\nreconciliation loop. As a result, you might see transient error messages in the\nlog during installation.\n\nAs long as the installation completes successfully, these errors can\nbe safely ignored. The following is a list of typical transient error log messages: \n\n Internal error occurred: failed calling webhook \"webhook.cert-manager.io\": Post\n https://cert-manager-webhook.cert-manager.svc:443/mutate?timeout=10s:\n dial tcp IP_ADDRESS:443: connect: connection refused\n\n Internal error occurred: failed calling webhook \"vcluster.kb.io\": Post\n https://webhook-service.kube-system.svc:443/validate-baremetal-cluster-gke-io-v1-cluster?timeout=30s:\n dial tcp IP_ADDRESS:443: connect: connection refused\n\n Failed to register cluster with GKE Hub; gcloud output: error running command\n 'gcloud container fleet memberships register CLUSTER_NAME --verbosity=error --quiet':\n error: exit status 1, stderr: 'ERROR: (gcloud.container.hub.memberships.register)\n Failed to check if the user is a cluster-admin: Unable to connect to the server: EOF\n\n Get\n https://127.0.0.1:34483/apis/infrastructure.baremetal.cluster.gke.io/v1/namespaces/cluster-\n cluster1/baremetalmachines: dial tcp 127.0.0.1:34483: connect: connection refused\"\n\n Create Kind Cluster \"msg\"=\"apply run failed\" \"error\"=\"unable to recognize \\\"/tmp/kout088683152\\\": no matches for kind \\\"NetworkLogging\\\" in version \\\"networking.gke.io/v1alpha1\\\"\"\n Create Kind Cluster \"msg\"=\"apply run failed\" \"error\"=\"unable to recognize \\\"/tmp/kout869681888\\\": no matches for kind \\\"Provider\\\" in version \\\"clusterctl.cluster.x-k8s.io/v1alpha3\\\"\"\n\nIf your Google Cloud service account key has expired, you will see the following\nerror messages from `bmctl`: \n\n Error validating cluster config: 3 errors occurred:\n * GKEConnect check failed: Get https://gkehub.googleapis.com/v1beta1/projects/project/locations/global/memberships/admin: oauth2: cannot fetch token: 400 Bad Request\n Response: {\"error\":\"invalid_grant\",\"error_description\":\"Invalid JWT Signature.\"}\n * ClusterOperations check failed: Post https://cloudresourcemanager.googleapis.com/v1/projects/project:testIamPermissions?alt=json&prettyPrint=false: oauth2: cannot fetch token: 400 Bad Request\n Response: {\"error\":\"invalid_grant\",\"error_description\":\"Invalid JWT Signature.\"}\n * GCR pull permission for bucket: artifacts.anthos-baremetal-release.appspot.com failed: Get https://storage.googleapis.com/storage/v1/b/artifacts.anthos-baremetal-release.appspot.com/iam/testPermissions?alt=json&permissions=storage.objects.get&permissions=storage.objects.list&prettyPrint=false: oauth2: cannot fetch token: 400 Bad Request\n Response: {\"error\":\"invalid_grant\",\"error_description\":\"Invalid JWT Signature.\"}\n\nYou will need to generate a [new service account key](https://cloud.google.com/iam/docs/creating-managing-service-account-keys#creating_service_account_keys)."]]
