{"record":{"id":"07cbac992dba4809","repo":"kubernetes/kops","slug":"empty-subscription-id-07cbac","errorCode":null,"errorMessage":"empty subscription ID","messagePattern":"empty subscription ID","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"upup/pkg/fi/cloudup/azure/verifier.go","lineNumber":302,"sourceCode":"\tsubscriptionID string\n\tresourceGroup  string\n\tnisClient      *network.InterfacesClient\n\tvmsClient      *compute.VirtualMachinesClient\n\tvmssVMsClient  *compute.VirtualMachineScaleSetVMsClient\n}\n\n// newVerifierClient builds Azure API clients scoped to the local instance's subscription and\n// resource group from IMDS metadata.\nfunc newVerifierClient(ctx context.Context) (*client, error) {\n\tmetadata, err := azuremetadata.QueryComputeInstanceMetadata(ctx)\n\tif err != nil || metadata == nil {\n\t\treturn nil, fmt.Errorf(\"getting instance metadata: %w\", err)\n\t}\n\tif metadata.ResourceGroupName == \"\" {\n\t\treturn nil, fmt.Errorf(\"empty resource group name\")\n\t}\n\tif metadata.SubscriptionID == \"\" {\n\t\treturn nil, fmt.Errorf(\"empty subscription ID\")\n\t}\n\tklog.V(4).Infof(\"Azure verifier client using subscription %q resource group %q\", metadata.SubscriptionID, metadata.ResourceGroupName)\n\n\tcred, err := azidentity.NewDefaultAzureCredential(nil)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"creating an identity: %w\", err)\n\t}\n\n\tnisClient, err := network.NewInterfacesClient(metadata.SubscriptionID, cred, nil)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"creating interfaces client: %w\", err)\n\t}\n\tvmsClient, err := compute.NewVirtualMachinesClient(metadata.SubscriptionID, cred, nil)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"creating VMs client: %w\", err)\n\t}\n\tvmssVMsClient, err := compute.NewVirtualMachineScaleSetVMsClient(metadata.SubscriptionID, cred, nil)\n\tif err != nil {","sourceCodeStart":284,"sourceCodeEnd":320,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/upup/pkg/fi/cloudup/azure/verifier.go#L284-L320","documentation":"Same bootstrap path as the resource-group check: metadata loaded fine but SubscriptionID is blank. The Azure SDK clients require a subscription ID, so the verifier returns this sentinel error instead of constructing invalid clients.","triggerScenarios":"QueryComputeInstanceMetadata returns metadata with SubscriptionID == \"\" — metadata response missing compute.subscriptionId, or a stubbed metadata source in tests/local runs.","commonSituations":"Non-Azure environment running verifier code; IMDS proxied/stubbed with incomplete JSON; extremely old metadata API version; corruption of IMDS response fields by middleboxes.","solutions":["Verify subscriptionId in IMDS: curl -H Metadata:true 'http://169.254.169.254/metadata/instance/compute?api-version=2021-02-01' | jq .subscriptionId","Bypass any HTTP(S)_PROXY or custom metadata endpoint overrides on the node","Confirm the node VM is deployed under a valid subscription and IMDS api-version is current","If in unit tests, populate the fake metadata struct's SubscriptionID before calling newVerifierClient"],"exampleFix":null,"handlingStrategy":"validation","validationCode":"m, err := azuremetadata.QueryComputeInstanceMetadata(ctx)\nif err == nil && m != nil && m.SubscriptionID == \"\" {\n\treturn fmt.Errorf(\"IMDS returned empty subscriptionId\")\n}","typeGuard":null,"tryCatchPattern":"_, err := newVerifierClient(ctx)\nif err != nil && strings.Contains(err.Error(), \"empty subscription ID\") {\n\t// environment problem: check IMDS response before retrying\n}","preventionTips":["Fail fast at bootstrap if IMDS fields are incomplete","Do not stub IMDS with partial JSON in images/tests","Keep IMDS api-version current","Verify subscriptionId via az metadata / curl at node init"],"tags":["azure","imds","subscription","metadata"],"backgroundTag":"empty-subscription-id","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T12:17:11.808Z"}