{"record":{"id":"c9dc91ffb78c6ed8","repo":"kubernetes/kops","slug":"instance-q-has-no-private-ipv4-address","errorCode":null,"errorMessage":"instance %q has no private IPv4 address","messagePattern":"instance %q has no private IPv4 address","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/bootstrap/awsbootstrap/verifier.go","lineNumber":343,"sourceCode":"\n\t\tfor _, a := range nic.Ipv6Addresses {\n\t\t\tif ip := aws.ToString(a.Ipv6Address); ip != \"\" {\n\t\t\t\tchallengeEndpoints = append(challengeEndpoints, net.JoinHostPort(ip, strconv.Itoa(wellknownports.NodeupChallenge)))\n\t\t\t}\n\t\t}\n\t}\n\n\tif len(challengeEndpoints) == 0 {\n\t\treturn nil, fmt.Errorf(\"cannot determine challenge endpoint for instance id: %s\", instanceID)\n\t}\n\n\tnodeName := addrs[0]\n\tif a.opt.UseIPBasedNodeNames {\n\t\t// Derive the node name with the same formula nodeup uses, so that the certificates are\n\t\t// issued for the exact name the node registers with, whatever the VPC DNS configuration.\n\t\tprivateIPv4 := aws.ToString(instance.PrivateIpAddress)\n\t\tif privateIPv4 == \"\" {\n\t\t\treturn nil, fmt.Errorf(\"instance %q has no private IPv4 address\", instanceID)\n\t\t}\n\t\tnodeName = PrivateDNSName(privateIPv4, a.opt.Region)\n\t\tif !slices.Contains(addrs, nodeName) {\n\t\t\taddrs = append(addrs, nodeName)\n\t\t}\n\t}\n\n\tresult := &bootstrap.VerifyResult{\n\t\tNodeName:          nodeName,\n\t\tCertificateNames:  addrs,\n\t\tChallengeEndpoint: challengeEndpoints[0],\n\t}\n\n\tfor _, tag := range instance.Tags {\n\t\ttagKey := aws.ToString(tag.Key)\n\t\tif tagKey == cloudTagInstanceGroupName {\n\t\t\tresult.InstanceGroupName = aws.ToString(tag.Value)\n\t\t}","sourceCodeStart":325,"sourceCodeEnd":361,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/pkg/bootstrap/awsbootstrap/verifier.go#L325-L361","documentation":"When UseIPBasedNodeNames is enabled, kOps derives the node's name from the instance's primary private IPv4 address (via PrivateDNSName) so issued certificates match exactly what nodeup registers, independent of VPC DNS settings. If the instance has no PrivateIpAddress set, that name cannot be derived and the verifier fails rather than issuing a certificate for a mismatched node name.","triggerScenarios":"verifyCallerIdentity (via verifyTokenV1/verifyTokenV2) runs with a.opt.UseIPBasedNodeNames=true and aws.ToString(instance.PrivateIpAddress) returns \"\" for the verified instance.","commonSituations":"Clusters configured with UseIPBasedNodeNames where the instance's primary ENI lacks a private IPv4 (IPv6-only setup, odd ENI state, or instance mid-initialization); mixed IPv6-only configurations that this name-derivation path doesn't support.","solutions":["Ensure the instance has a primary private IPv4 address on its main ENI; IPv6-only instances are not supported by this code path.","Retry after the instance finishes initializing if it was captured mid-setup.","Disable UseIPBasedNodeNames if your environment relies on IPv6-only or DNS-based node naming, so names come from GetInstanceCertificateNames instead.","Verify VPC/ENI settings in AWS so the primary network interface always carries a private IPv4."],"exampleFix":"// Cluster spec change for IPv6-only environments:\n// before\nkubelet:\n  ...\nspec:\n  useIPBasedNodeNames: true\n// after\nspec:\n  useIPBasedNodeNames: false","handlingStrategy":"validation","validationCode":"out, _ := ec2Client.DescribeInstances(ctx, &ec2.DescribeInstancesInput{InstanceIds: []string{instanceID}})\ninst, ok := exactlyOneInstance(out)\nif !ok { return fmt.Errorf(\"instance %s not found\", instanceID) }\nif useIPBasedNodeNames && aws.ToString(inst.PrivateIpAddress) == \"\" {\n  return fmt.Errorf(\"instance %s lacks private IPv4 required by useIPBasedNodeNames\", instanceID)\n}","typeGuard":"func supportsIPBasedNodeNames(inst types.Instance) bool {\n  return aws.ToString(inst.PrivateIpAddress) != \"\"\n}","tryCatchPattern":"result, err := verifier.VerifyToken(ctx, token)\nif err != nil && strings.Contains(err.Error(), \"has no private IPv4 address\") {\n  return nil, fmt.Errorf(\"node cannot bootstrap: useIPBasedNodeNames requires a private IPv4; disable it or fix ENI config: %w\", err)\n}","preventionTips":["Only enable useIPBasedNodeNames on clusters whose nodes always have private IPv4 addresses.","For IPv6-only node pools, disable useIPBasedNodeNames so names derive from certificate names instead.","Check ENI state during launch; retry after the primary ENI has a private IPv4."],"tags":["aws","ec2","ipv4","node-naming"],"backgroundTag":"missing-private-ipv4-address","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T07:17:12.445Z"}