{"record":{"id":"b2eebed84134b3e5","repo":"kubernetes/kops","slug":"host-not-found-for-v","errorCode":null,"errorMessage":"host not found for %v","messagePattern":"host not found for (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/bootstrap/pkibootstrap/pkiverifier/verifier.go","lineNumber":141,"sourceCode":"\t}\n\n\tif !verifySignature(signingKey, token.Data, token.Signature) {\n\t\treturn nil, fmt.Errorf(\"failed to verify claim signature for node\")\n\t}\n\n\treturn result, nil\n}\n\nfunc (v *verifier) getSigningKey(ctx context.Context, tokenData *pkibootstrap.AuthTokenData) (*bootstrap.VerifyResult, crypto.PublicKey, error) {\n\tnodeName := tokenData.Instance\n\tid := types.NamespacedName{\n\t\tNamespace: \"kops-system\",\n\t\tName:      nodeName,\n\t}\n\tvar host kops.Host\n\tif err := v.client.Get(ctx, id, &host); err != nil {\n\t\tif apierrors.IsNotFound(err) {\n\t\t\treturn nil, nil, fmt.Errorf(\"host not found for %v\", id)\n\t\t}\n\t\treturn nil, nil, fmt.Errorf(\"error getting host %v: %w\", id, err)\n\t}\n\n\t// TODO: Check instance-group matches request (does it matter?)\n\n\tif host.Spec.PublicKey == \"\" {\n\t\treturn nil, nil, fmt.Errorf(\"host %v did not have public-key\", id)\n\t}\n\tinstanceGroup := host.Spec.InstanceGroup\n\tif instanceGroup == \"\" {\n\t\treturn nil, nil, fmt.Errorf(\"host %v did not have spec.instanceGroup\", id)\n\t}\n\tpubKey, err := pki.ParsePEMPublicKey([]byte(host.Spec.PublicKey))\n\tif err != nil {\n\t\treturn nil, nil, fmt.Errorf(\"failed to parse public key: %w\", err)\n\t}\n","sourceCodeStart":123,"sourceCodeEnd":159,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/pkg/bootstrap/pkibootstrap/pkiverifier/verifier.go#L123-L159","documentation":"getSigningKey looks up a kops.Host resource in the kops-system namespace whose name equals the node name from the bootstrap token. When the controller-runtime client Get returns an IsNotFound error, the verifier rejects the token with \"host not found for <NamespacedName>\". This means no Host object has been registered (or no longer exists) for the machine attempting PKI bootstrap.","triggerScenarios":"A node calls kops-controller's bootstrap VerifyToken with a valid signed token, but the Host object named tokenData.Instance (namespace kops-system) does not exist in the cluster, e.g. the Host CR was never created, was deleted, or the token's Instance field names a node with no matching Host.","commonSituations":"Cluster upgraded to the machine-key/PKI bootstrap flow without creating Host resources; Host CR deleted by automation or by mistake; node renamed or replaced but Host record not updated; node name casing mismatch between cloud provider metadata and the Host object name; RBAC/namespace issues are NOT the cause here (those hit the second error).","solutions":["Create (or recreate) the kops.Host resource in the kops-system namespace with metadata.name matching the node name from the token","Verify the node's reported instance name (tokenData.Instance) matches the Host object name exactly; fix node metadata or Host metadata if they diverge","Confirm the Host CRD is installed and that whatever reconciles Host objects (the cloud provider integration) is running","Check kops-controller logs for the full NamespacedName to see which name/namespace was requested"],"exampleFix":"// before: node bootstraps but no Host exists\n// kubectl get host -n kops-system node1 -> NotFound\n\n// after: register the host\n// kubectl apply -f - <<EOF\n// apiVersion: kops.k8s.io/v1alpha2\n// kind: Host\n// metadata:\n//   name: node1\n//   namespace: kops-system\n// spec:\n//   publicKey: <PEM public key>\n//   instanceGroup: nodes\n// EOF","handlingStrategy":"validation","validationCode":"var host kops.Host\nif err := c.Get(ctx, types.NamespacedName{Namespace: \"kops-system\", Name: nodeName}, &host); err != nil {\n    if apierrors.IsNotFound(err) {\n        return fmt.Errorf(\"Host %s/%s does not exist; create it before bootstrapping\", \"kops-system\", nodeName)\n    }\n    return err\n}","typeGuard":"func hostExists(ctx context.Context, c client.Client, nodeName string) bool {\n    var h kops.Host\n    return c.Get(ctx, types.NamespacedName{Namespace: \"kops-system\", Name: nodeName}, &h) == nil\n}","tryCatchPattern":"result, err := verifier.VerifyToken(ctx, req, token, body)\nif err != nil {\n    if strings.Contains(err.Error(), \"host not found for\") {\n        // register/recreate the Host object then retry bootstrap\n        return bootstrapHost(nodeName)\n    }\n    return err\n}","preventionTips":["Ensure Host objects are created as part of node provisioning before nodeup runs","Keep Host names exactly matching cloud instance/node names","Monitor for Host deletion events in kops-system namespace","Include Host CR existence in cluster upgrade checklists"],"tags":["kubernetes","bootstrap","pki","not-found"],"backgroundTag":"resource-not-found","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T07:17:12.445Z"}