{"record":{"id":"7ce3814cfaa7877e","repo":"kubernetes/kops","slug":"attested-subscriptionid-q-does-not-match-verifier","errorCode":null,"errorMessage":"attested subscriptionId %q does not match verifier subscription %q","messagePattern":"attested subscriptionId %q does not match verifier subscription %q","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"upup/pkg/fi/cloudup/azure/verifier.go","lineNumber":151,"sourceCode":"\t}\n\tswitch resourceType {\n\tcase vmResourceType:\n\tcase vmssVMResourceType:\n\t\tif !strings.HasSuffix(res.Parent.Name, \".\"+a.clusterName) {\n\t\t\treturn nil, fmt.Errorf(\"resource ID VMSS name %q does not match cluster name %q\", res.Parent.Name, a.clusterName)\n\t\t}\n\tdefault:\n\t\treturn nil, fmt.Errorf(\"unsupported resource type %q\", resourceType)\n\t}\n\n\t// Verify the PKCS7 attested document: signature, certificate chain, nonce, and expiration.\n\tdata, err := a.attestation.verifyAttestedDocument(signature, body)\n\tif err != nil {\n\t\treturn nil, err\n\t}\n\tklog.V(2).Infof(\"Azure verifier for VM %q verified attested document\", vmLogID)\n\tif !strings.EqualFold(data.SubscriptionId, a.client.subscriptionID) {\n\t\treturn nil, fmt.Errorf(\"attested subscriptionId %q does not match verifier subscription %q\", data.SubscriptionId, a.client.subscriptionID)\n\t}\n\n\t// Look up the VM or VMSS VM via the Azure API using the resource ID, cross-verify the attested\n\t// vmId, and extract node identity.\n\tvar nodeName, igName string\n\tvar addrs, challengeEndpoints []string\n\n\tswitch resourceType {\n\tcase vmResourceType:\n\t\tvmName := res.Name\n\t\tdesc := fmt.Sprintf(\"VM %q\", vmName)\n\t\tklog.V(2).Infof(\"Azure verifier for VM %q looking up Azure API object\", vmLogID)\n\n\t\tvm, err := a.client.vmsClient.Get(ctx, a.client.resourceGroup, vmName, nil)\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"getting info for %s: %w\", desc, err)\n\t\t}\n\t\tif vm.Properties == nil {","sourceCodeStart":133,"sourceCodeEnd":169,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/upup/pkg/fi/cloudup/azure/verifier.go#L133-L169","documentation":"After the PKCS7 attested document is cryptographically verified, the subscription ID inside the attested payload does not match the verifier's subscription. This means the signature is valid but the attested VM lives in a different subscription than the one kops-controller manages, indicating a cross-subscription credential or a re-used attestation token.","triggerScenarios":"Thrown at upup/pkg/fi/cloudup/azure/verifier.go:151 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Confirm the attestation token was generated on a VM in the verifier's subscription","Check for replayed or cached attestation tokens from another deployment","Verify the cluster's Azure subscription configuration"],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T12:17:11.808Z"}