{"record":{"id":"7f66b7cdb820f85b","repo":"kubernetes/kops","slug":"determining-ig-name-for-s","errorCode":null,"errorMessage":"determining IG name for %s","messagePattern":"determining IG name for (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"upup/pkg/fi/cloudup/azure/verifier.go","lineNumber":259,"sourceCode":"func extractNodeIdentity(data *attestedData, desc string, apiVMID *string, osProfile *compute.OSProfile, tags map[string]*string) (nodeName, igName string, err error) {\n\tif apiVMID == nil {\n\t\treturn \"\", \"\", fmt.Errorf(\"determining VMID for %s\", desc)\n\t}\n\n\t// Cross-verify: the vmId from the cryptographically signed attested document must match the vmId from the\n\t// Azure API for the claimed resource ID.\n\tklog.V(4).Infof(\"Azure verifier for %s cross-verifying vmId: attested=%q api=%q\", desc, data.VMId, *apiVMID)\n\tif data.VMId != *apiVMID {\n\t\treturn \"\", \"\", fmt.Errorf(\"attested vmId %q does not match %s (API vmId %q)\", data.VMId, desc, *apiVMID)\n\t}\n\tif osProfile == nil || osProfile.ComputerName == nil || *osProfile.ComputerName == \"\" {\n\t\treturn \"\", \"\", fmt.Errorf(\"determining ComputerName for %s\", desc)\n\t}\n\n\tnodeName = strings.ToLower(*osProfile.ComputerName)\n\tigNameTag, ok := tags[InstanceGroupNameTag]\n\tif !ok || igNameTag == nil {\n\t\treturn \"\", \"\", fmt.Errorf(\"determining IG name for %s\", desc)\n\t}\n\tklog.V(4).Infof(\"Azure verifier for %s resolved identity: node=%q instanceGroup=%q\", desc, nodeName, *igNameTag)\n\n\treturn nodeName, *igNameTag, nil\n}\n\n// privateIPEndpoints collects the private IP addresses and nodeup challenge endpoints from a\n// network interface's IP configurations.\nfunc privateIPEndpoints(ni network.Interface, desc string) (addrs, challengeEndpoints []string, err error) {\n\tif ni.Properties == nil {\n\t\treturn nil, nil, fmt.Errorf(\"determining IP configurations for %s network interface\", desc)\n\t}\n\n\tfor _, ipc := range ni.Properties.IPConfigurations {\n\t\tif ipc.Properties != nil && ipc.Properties.PrivateIPAddress != nil {\n\t\t\taddrs = append(addrs, *ipc.Properties.PrivateIPAddress)\n\t\t\tchallengeEndpoints = append(challengeEndpoints, net.JoinHostPort(*ipc.Properties.PrivateIPAddress, strconv.Itoa(wellknownports.NodeupChallenge)))\n\t\t}","sourceCodeStart":241,"sourceCodeEnd":277,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/upup/pkg/fi/cloudup/azure/verifier.go#L241-L277","documentation":"The verifier resolves which instance group a node belongs to by reading the kops InstanceGroupNameTag off the VM's Azure tags. If the tag is missing or nil, node identity cannot be completed and token verification is rejected.","triggerScenarios":"The VM's tags map lacks the InstanceGroupNameTag key, or the tag value pointer is nil, after a successful Get of the VM in extractNodeIdentity.","commonSituations":"Someone edited/removed kops-managed tags in the Azure portal; VM was created outside kops (e.g. manually or via VMSS reimage losing tags); tag propagation delay right after instance creation; a tag policy/azure policy stripped custom tags.","solutions":["Re-add the kops instance-group tag on the VM (kops-cloud-azure-instance-group-name style key) or run `kops update cluster --yes` / `kops rolling-update cluster` to restore managed tags","Check Azure Policy or tag governance that could block kops tags on resources","If the node was just created, wait/retry until kops tagged it, then restart the failed verification","Verify the node belongs to the cluster — nodes created outside kops will never carry the tag and cannot verify"],"exampleFix":"// before (VM missing tag)\n$ az vm show -g rg -n node1 --query tags   # {} \n// after: restore via kops\n$ kops update cluster --name mycluster --yes   # re-applies kops tags to Azure VMs","handlingStrategy":"validation","validationCode":"vm, err := vmsClient.Get(ctx, rg, name, nil)\nif err != nil { return err }\nif v, ok := vm.Tags[cloudtags.InstanceGroupNameTag]; !ok || v == nil || *v == \"\" {\n\treturn fmt.Errorf(\"VM %s missing kops instance-group tag %s\", name, cloudtags.InstanceGroupNameTag)\n}","typeGuard":"func hasIGTag(vm *compute.VirtualMachine, tag string) bool {\n\treturn vm != nil && vm.Tags != nil && vm.Tags[tag] != nil && *vm.Tags[tag] != \"\"\n}","tryCatchPattern":"_, _, err := verifier.VerifyToken(ctx, token)\nif err != nil && strings.Contains(err.Error(), \"determining IG name\") {\n\t// re-apply kops-managed tags (kops update cluster) before retrying\n}","preventionTips":["Never delete or edit kops-* tags in the Azure portal","Enforce Azure Policy that only kops may modify kops-owned tags","Run `kops update cluster` after out-of-band VM changes","Reimage VMSS nodes through kops so tags propagate"],"tags":["azure","tags","instance-group","kops"],"backgroundTag":"missing-kops-tag","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T12:17:11.808Z"}