{"record":{"id":"3928f2b617e1ca04","repo":"kubernetes/kops","slug":"empty-subscription-id","errorCode":null,"errorMessage":"empty subscription ID","messagePattern":"empty subscription ID","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/nodeidentity/azure/client.go","lineNumber":46,"sourceCode":")\n\n// client is an Azure client.\ntype client struct {\n\tsubscriptionID string\n\tvmClient       *compute.VirtualMachinesClient\n\tvmssClient     *compute.VirtualMachineScaleSetVMsClient\n}\n\n// newClient returns a new Client.\nfunc newClient() (*client, error) {\n\t// nodeidentity.Identifier.New does not propagate a context; the IMDS HTTP client's own timeout\n\t// bounds this call.\n\tmetadata, err := azuremetadata.QueryComputeInstanceMetadata(context.TODO())\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"error querying instance metadata: %s\", err)\n\t}\n\tif metadata.SubscriptionID == \"\" {\n\t\treturn nil, fmt.Errorf(\"empty subscription ID\")\n\t}\n\n\tcred, err := azidentity.NewDefaultAzureCredential(nil)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"creating identity: %w\", err)\n\t}\n\n\tvmClient, err := compute.NewVirtualMachinesClient(metadata.SubscriptionID, cred, nil)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"creating VMs client: %w\", err)\n\t}\n\n\tvmssClient, err := compute.NewVirtualMachineScaleSetVMsClient(metadata.SubscriptionID, cred, nil)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"creating VMSS VMs client: %w\", err)\n\t}\n\n\treturn &client{","sourceCodeStart":28,"sourceCodeEnd":64,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/pkg/nodeidentity/azure/client.go#L28-L64","documentation":"newClient queries the Azure Instance Metadata Service (IMDS) to learn which subscription the node belongs to. If the metadata response returns successfully but SubscriptionID is an empty string, the client cannot be constructed, so this error is thrown. It indicates an IMDS response that is structurally valid but missing the subscription field.","triggerScenarios":"azuremetadata.QueryComputeInstanceMetadata returns a response whose SubscriptionID field is empty — e.g. the IMDS endpoint replied but the subscriptionId attribute was absent or blank.","commonSituations":"Running kops node code outside an Azure VM (IMDS is reachable only from Azure infrastructure), IMDS proxied/mocked or returning degraded data, unusual networking setups (custom metadata proxies, nested virtualization) that return partial payloads, or interception by security appliances that strip fields.","solutions":["Verify the workload is actually running on an Azure VM or VMSS with IMDS reachable at 169.254.169.254","Curl the IMDS endpoint and inspect the JSON: curl -H Metadata:true 'http://169.254.169.254/metadata/instance/compute?api-version=2021-02-01' to confirm subscriptionId is present","If running off-cluster/off-Azure, run nodeidentity only on Azure nodes; it is not designed for non-Azure environments","Check for IMDS-blocking or IMDS-mutating network appliances/proxies and exclude 169.254.169.254 from them"],"exampleFix":"// debug before creating client\nmetadata, err := azuremetadata.QueryComputeInstanceMetadata(context.TODO())\nif err != nil {\n    return nil, fmt.Errorf(\"error querying instance metadata: %s\", err)\n}\n// after (add diagnostics to pinpoint empty response)\nif metadata.SubscriptionID == \"\" {\n    return nil, fmt.Errorf(\"empty subscription ID (IMDS returned metadata without subscriptionId; is this an Azure VM?)\")\n}","handlingStrategy":"validation","validationCode":"if metadata.SubscriptionID == \"\" {\n    return fmt.Errorf(\"IMDS metadata has no subscription ID; not running on an Azure VM?\")\n}","typeGuard":null,"tryCatchPattern":"if err != nil {\n    if strings.Contains(err.Error(), \"empty subscription ID\") {\n        // treat as non-Azure or degraded IMDS; skip node identity lookup\n    }\n}","preventionTips":["Only run Azure nodeidentity code on nodes in Azure","Sanity-check IMDS output: curl -H Metadata:true 'http://169.254.169.254/metadata/instance/compute?api-version=2021-02-01'","Exclude 169.254.169.254 from proxies/security appliances","Log the full IMDS payload when subscriptionId is missing to aid diagnosis"],"tags":["azure","imds","configuration","metadata"],"backgroundTag":"azure-imds-metadata-unavailable","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T07:17:12.445Z"}