{"record":{"id":"20b42694972dac06","repo":"kubernetes/kops","slug":"resource-id-vmss-name-q-does-not-match-cluster-na","errorCode":null,"errorMessage":"resource ID VMSS name %q does not match cluster name %q","messagePattern":"resource ID VMSS name %q does not match cluster name %q","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"upup/pkg/fi/cloudup/azure/verifier.go","lineNumber":138,"sourceCode":"\tvmLogID := vmLogIDFromResource(res)\n\tresourceType := res.ResourceType.String()\n\tklog.V(4).Infof(\"Azure verifier for VM %q parsed resource ID: subscription=%q resourceGroup=%q\", vmLogID, res.SubscriptionID, res.ResourceGroupName)\n\n\t// Reject resource IDs outside the verifier's own subscription / resource group. The Azure API lookup below\n\t// is already scoped to kops-controller's subscription and resource group, so any claim that names a different\n\t// location cannot describe a cluster VM. Failing here avoids a wasted Azure API call and makes the scope\n\t// explicit instead of implicit.\n\tif !strings.EqualFold(res.SubscriptionID, a.client.subscriptionID) {\n\t\treturn nil, fmt.Errorf(\"resource ID subscription %q does not match verifier subscription %q\", res.SubscriptionID, a.client.subscriptionID)\n\t}\n\tif !strings.EqualFold(res.ResourceGroupName, a.client.resourceGroup) {\n\t\treturn nil, fmt.Errorf(\"resource ID resource group %q does not match verifier resource group %q\", res.ResourceGroupName, a.client.resourceGroup)\n\t}\n\tswitch resourceType {\n\tcase vmResourceType:\n\tcase vmssVMResourceType:\n\t\tif !strings.HasSuffix(res.Parent.Name, \".\"+a.clusterName) {\n\t\t\treturn nil, fmt.Errorf(\"resource ID VMSS name %q does not match cluster name %q\", res.Parent.Name, a.clusterName)\n\t\t}\n\tdefault:\n\t\treturn nil, fmt.Errorf(\"unsupported resource type %q\", resourceType)\n\t}\n\n\t// Verify the PKCS7 attested document: signature, certificate chain, nonce, and expiration.\n\tdata, err := a.attestation.verifyAttestedDocument(signature, body)\n\tif err != nil {\n\t\treturn nil, err\n\t}\n\tklog.V(2).Infof(\"Azure verifier for VM %q verified attested document\", vmLogID)\n\tif !strings.EqualFold(data.SubscriptionId, a.client.subscriptionID) {\n\t\treturn nil, fmt.Errorf(\"attested subscriptionId %q does not match verifier subscription %q\", data.SubscriptionId, a.client.subscriptionID)\n\t}\n\n\t// Look up the VM or VMSS VM via the Azure API using the resource ID, cross-verify the attested\n\t// vmId, and extract node identity.\n\tvar nodeName, igName string","sourceCodeStart":120,"sourceCodeEnd":156,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/upup/pkg/fi/cloudup/azure/verifier.go#L120-L156","documentation":"For a VMSS-backed instance, the parent VMSS name in the resource ID does not end with '.' + cluster name, meaning the token claims membership in a scale set that does not belong to this cluster. The verifier only accepts VMSS VMs whose scale set is named after the cluster, so the claim is rejected before the Azure API is consulted.","triggerScenarios":"Thrown at upup/pkg/fi/cloudup/azure/verifier.go:138 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Verify the VMSS the node belongs to was created by this kops cluster","Check the cluster name in the token/resource ID for typos or drift","Reject the token: the node does not belong to this cluster's scale sets"],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T07:17:12.445Z"}