{"record":{"id":"61ef4fe6de01cf49","repo":"kubernetes/kops","slug":"cannot-determine-challenge-endpoint-for-instance-i","errorCode":null,"errorMessage":"cannot determine challenge endpoint for instance id: %s","messagePattern":"cannot determine challenge endpoint for instance id: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/bootstrap/awsbootstrap/verifier.go","lineNumber":334,"sourceCode":"\tfor _, nic := range instance.NetworkInterfaces {\n\t\tif ip := aws.ToString(nic.PrivateIpAddress); ip != \"\" {\n\t\t\tchallengeEndpoints = append(challengeEndpoints, net.JoinHostPort(ip, strconv.Itoa(wellknownports.NodeupChallenge)))\n\t\t}\n\t\tfor _, a := range nic.PrivateIpAddresses {\n\t\t\tif ip := aws.ToString(a.PrivateIpAddress); ip != \"\" {\n\t\t\t\tchallengeEndpoints = append(challengeEndpoints, net.JoinHostPort(ip, strconv.Itoa(wellknownports.NodeupChallenge)))\n\t\t\t}\n\t\t}\n\n\t\tfor _, a := range nic.Ipv6Addresses {\n\t\t\tif ip := aws.ToString(a.Ipv6Address); ip != \"\" {\n\t\t\t\tchallengeEndpoints = append(challengeEndpoints, net.JoinHostPort(ip, strconv.Itoa(wellknownports.NodeupChallenge)))\n\t\t\t}\n\t\t}\n\t}\n\n\tif len(challengeEndpoints) == 0 {\n\t\treturn nil, fmt.Errorf(\"cannot determine challenge endpoint for instance id: %s\", instanceID)\n\t}\n\n\tnodeName := addrs[0]\n\tif a.opt.UseIPBasedNodeNames {\n\t\t// Derive the node name with the same formula nodeup uses, so that the certificates are\n\t\t// issued for the exact name the node registers with, whatever the VPC DNS configuration.\n\t\tprivateIPv4 := aws.ToString(instance.PrivateIpAddress)\n\t\tif privateIPv4 == \"\" {\n\t\t\treturn nil, fmt.Errorf(\"instance %q has no private IPv4 address\", instanceID)\n\t\t}\n\t\tnodeName = PrivateDNSName(privateIPv4, a.opt.Region)\n\t\tif !slices.Contains(addrs, nodeName) {\n\t\t\taddrs = append(addrs, nodeName)\n\t\t}\n\t}\n\n\tresult := &bootstrap.VerifyResult{\n\t\tNodeName:          nodeName,","sourceCodeStart":316,"sourceCodeEnd":352,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/pkg/bootstrap/awsbootstrap/verifier.go#L316-L352","documentation":"After identifying the bootstrapping instance, the verifier builds the list of challenge endpoints (IP:port where nodeup listens for cert challenges) from every private IPv4 and IPv6 address on the instance's ENIs, using wellknownports.NodeupChallenge. If the instance's network interfaces expose no private IP addresses at all, there is no endpoint to reach nodeup on, so verification fails.","triggerScenarios":"verifyCallerIdentity (via verifyTokenV1/verifyTokenV2) iterates instance.NetworkInterfaces and finds no non-empty nic.PrivateIpAddress, no PrivateIpAddresses entries, and no Ipv6Addresses — challengeEndpoints stays empty.","commonSituations":"Instance still initializing so ENI addresses aren't attached/reported yet; an ENI in a weird state (pending attach); instances launched with unusual networking (e.g. custom CNI removing primary private IP); a stale EC2 response from a caching layer.","solutions":["Wait for the instance to fully initialize and retry verification; ENI private IPs may not have been reported at DescribeInstances time.","Check the instance's ENIs in the AWS console/CLI (aws ec2 describe-network-interfaces) to confirm each has a primary private IPv4 address.","Ensure the node uses standard VPC networking with a primary ENI that has a private IP; reattach/replace broken ENIs.","If using IP-based node names, also confirm Ipv6Addresses or private IPv4s exist on at least one interface."],"exampleFix":null,"handlingStrategy":"validation","validationCode":"out, _ := ec2Client.DescribeInstances(ctx, &ec2.DescribeInstancesInput{InstanceIds: []string{instanceID}})\ninst, ok := exactlyOneInstance(out)\nif !ok { return fmt.Errorf(\"instance %s not found\", instanceID) }\nhasAddr := false\nfor _, nic := range inst.NetworkInterfaces {\n  if aws.ToString(nic.PrivateIpAddress) != \"\" || len(nic.PrivateIpAddresses) > 0 || len(nic.Ipv6Addresses) > 0 {\n    hasAddr = true\n  }\n}\nif !hasAddr { return fmt.Errorf(\"instance %s has no private addresses yet; wait for ENI attach\", instanceID) }","typeGuard":"func hasChallengeEndpoint(inst types.Instance) bool {\n  for _, nic := range inst.NetworkInterfaces {\n    if aws.ToString(nic.PrivateIpAddress) != \"\" { return true }\n    if len(nic.PrivateIpAddresses) > 0 || len(nic.Ipv6Addresses) > 0 { return true }\n  }\n  return false\n}","tryCatchPattern":"result, err := verifier.VerifyToken(ctx, token)\nif err != nil && strings.Contains(err.Error(), \"cannot determine challenge endpoint\") {\n  // wait for ENI addresses to populate, then retry\n  time.Sleep(10 * time.Second)\n  return verifier.VerifyToken(ctx, token)\n}","preventionTips":["Wait for the instance to reach running/fully-initialized state before requesting bootstrap verification.","Verify ENIs have primary private IPs via aws ec2 describe-network-interfaces before bootstrapping.","Avoid custom networking that strips private IPs from the primary ENI."],"tags":["aws","ec2","networking","bootstrap"],"backgroundTag":"missing-network-interface-address","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T07:17:12.445Z"}