{"record":{"id":"8ecf9855062ddc8c","repo":"kubernetes/kops","slug":"authentication-request-address-q-does-not-match-s","errorCode":null,"errorMessage":"authentication request address %q does not match server addresses %v","messagePattern":"authentication request address %q does not match server addresses (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"upup/pkg/fi/cloudup/openstack/verifier.go","lineNumber":154,"sourceCode":"\n\tvar addresses map[string][]Address\n\terr = mapstructure.Decode(instance.Addresses, &addresses)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"unable to decode addresses: %w\", err)\n\t}\n\n\tfor _, addrList := range addresses {\n\t\tfor _, props := range addrList {\n\t\t\taddrs = append(addrs, props.Addr)\n\t\t}\n\t}\n\t// ensure that request is coming from same machine\n\trequestAddr, _, err := net.SplitHostPort(rawRequest.RemoteAddr)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"invalid remote address %q: %v\", rawRequest.RemoteAddr, err)\n\t}\n\tif !stringInSlice(requestAddr, addrs) {\n\t\treturn nil, fmt.Errorf(\"authentication request address %q does not match server addresses %v\", requestAddr, addrs)\n\t}\n\n\t// We will call back onto this address, now that we have verified it is an instance IP\n\tchallengeEndpoint := net.JoinHostPort(requestAddr, strconv.Itoa(wellknownports.NodeupChallenge))\n\n\t// check from kubernetes API does the instance already exist\n\t_, err = o.kubeClient.CoreV1().Nodes().Get(ctx, instance.Name, v1.GetOptions{})\n\tif err == nil {\n\t\treturn nil, bootstrap.ErrAlreadyExists\n\t}\n\tif err != nil && !errors.IsNotFound(err) {\n\t\treturn nil, fmt.Errorf(\"got error while querying kubernetes api: %w\", err)\n\t}\n\n\tresult := &bootstrap.VerifyResult{\n\t\tNodeName:          instance.Name,\n\t\tCertificateNames:  addrs,\n\t\tChallengeEndpoint: challengeEndpoint,","sourceCodeStart":136,"sourceCodeEnd":172,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/upup/pkg/fi/cloudup/openstack/verifier.go#L136-L172","documentation":"The source IP of the bootstrap request does not match any address of the server named in the token. This is the core anti-spoofing check: only the instance itself should be able to present its token, so a request from an unrelated address is rejected.","triggerScenarios":"Thrown at upup/pkg/fi/cloudup/openstack/verifier.go:154 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Verify the request is not arriving via a NAT/proxy that changes the source address","Confirm the requester is the OpenStack instance named in the token","Check that the instance's addresses include the request's source IP"],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T12:17:11.808Z"}