{"record":{"id":"7c9d3638cfd5e0b1","repo":"kubernetes/kops","slug":"determining-certificate-alternate-names-for-node","errorCode":null,"errorMessage":"determining certificate alternate names for node %q","messagePattern":"determining certificate alternate names for node %q","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"upup/pkg/fi/cloudup/azure/verifier.go","lineNumber":221,"sourceCode":"\t\t}\n\n\t\t// Collect private IP addresses from the VMSS VM's network interface.\n\t\tni, err := a.client.nisClient.GetVirtualMachineScaleSetNetworkInterface(ctx, a.client.resourceGroup, vmssName, vmssIndex, vmssName, nil)\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"getting info for %s network interface: %w\", desc, err)\n\t\t}\n\t\taddrs, challengeEndpoints, err = privateIPEndpoints(ni.Interface, desc)\n\t\tif err != nil {\n\t\t\treturn nil, err\n\t\t}\n\n\tdefault:\n\t\treturn nil, fmt.Errorf(\"unsupported resource type %q\", resourceType)\n\t}\n\n\t// Validate that we found at least one address and challenge endpoint.\n\tif len(addrs) == 0 {\n\t\treturn nil, fmt.Errorf(\"determining certificate alternate names for node %q\", nodeName)\n\t}\n\tif len(challengeEndpoints) == 0 {\n\t\treturn nil, fmt.Errorf(\"determining challenge endpoint for node %q\", nodeName)\n\t}\n\n\tresult := &bootstrap.VerifyResult{\n\t\tNodeName:          nodeName,\n\t\tInstanceGroupName: igName,\n\t\tCertificateNames:  addrs,\n\t\tChallengeEndpoint: challengeEndpoints[0],\n\t}\n\n\tklog.V(2).Infof(\"Azure verifier for VM %q verified as node %q in instance group %q\", vmLogID, nodeName, igName)\n\treturn result, nil\n}\n\n// extractNodeIdentity cross-verifies the attested vmId against the Azure API vmId for the claimed resource and\n// extracts the node name and instance group from the API object. desc is a human-readable resource description","sourceCodeStart":203,"sourceCodeEnd":239,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/upup/pkg/fi/cloudup/azure/verifier.go#L203-L239","documentation":"Post-collection guard in VerifyToken: after gathering private IP endpoints for the node, at least one address is required to build the certificate SANs. Fires when the NIC/instance yielded no usable private IP addresses, so there is nothing to put in the node's TLS certificate alternate names.","triggerScenarios":"Thrown at upup/pkg/fi/cloudup/azure/verifier.go:221 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Check that the VM/VMSS instance has a NIC with an attached IP configuration holding a private IP","Ensure the IP configuration is not in a failed provisioning state","Re-run the bootstrap request once the instance networking is fully provisioned"],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T12:17:11.808Z"}