{"record":{"id":"61792e7c48538eba","repo":"kubernetes/kops","slug":"determining-challenge-endpoint-for-node-q","errorCode":null,"errorMessage":"determining challenge endpoint for node %q","messagePattern":"determining challenge endpoint for node %q","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"upup/pkg/fi/cloudup/azure/verifier.go","lineNumber":224,"sourceCode":"\t\tni, err := a.client.nisClient.GetVirtualMachineScaleSetNetworkInterface(ctx, a.client.resourceGroup, vmssName, vmssIndex, vmssName, nil)\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"getting info for %s network interface: %w\", desc, err)\n\t\t}\n\t\taddrs, challengeEndpoints, err = privateIPEndpoints(ni.Interface, desc)\n\t\tif err != nil {\n\t\t\treturn nil, err\n\t\t}\n\n\tdefault:\n\t\treturn nil, fmt.Errorf(\"unsupported resource type %q\", resourceType)\n\t}\n\n\t// Validate that we found at least one address and challenge endpoint.\n\tif len(addrs) == 0 {\n\t\treturn nil, fmt.Errorf(\"determining certificate alternate names for node %q\", nodeName)\n\t}\n\tif len(challengeEndpoints) == 0 {\n\t\treturn nil, fmt.Errorf(\"determining challenge endpoint for node %q\", nodeName)\n\t}\n\n\tresult := &bootstrap.VerifyResult{\n\t\tNodeName:          nodeName,\n\t\tInstanceGroupName: igName,\n\t\tCertificateNames:  addrs,\n\t\tChallengeEndpoint: challengeEndpoints[0],\n\t}\n\n\tklog.V(2).Infof(\"Azure verifier for VM %q verified as node %q in instance group %q\", vmLogID, nodeName, igName)\n\treturn result, nil\n}\n\n// extractNodeIdentity cross-verifies the attested vmId against the Azure API vmId for the claimed resource and\n// extracts the node name and instance group from the API object. desc is a human-readable resource description\n// used in errors and logs.\nfunc extractNodeIdentity(data *attestedData, desc string, apiVMID *string, osProfile *compute.OSProfile, tags map[string]*string) (nodeName, igName string, err error) {\n\tif apiVMID == nil {","sourceCodeStart":206,"sourceCodeEnd":242,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/upup/pkg/fi/cloudup/azure/verifier.go#L206-L242","documentation":"Post-collection guard in VerifyToken: the node bootstrap challenge requires an HTTP challenge endpoint served on the node's private IP, but none was derived from the collected endpoints. Fires when privateIPEndpoints returned no challenge endpoints, making node-identity challenge verification impossible.","triggerScenarios":"Thrown at upup/pkg/fi/cloudup/azure/verifier.go:224 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Verify the node's private IP is reachable and the challenge server (kops-controller/nodeup) is running","Check that the NIC IP configuration exposes a private IPv4 address","Re-run node bootstrap after networking on the instance is healthy"],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T07:17:12.445Z"}