{"record":{"id":"cafb6bf9d59f53bb","repo":"kubernetes/kops","slug":"host-v-did-not-have-spec-instancegroup","errorCode":null,"errorMessage":"host %v did not have spec.instanceGroup","messagePattern":"host (.+?) did not have spec\\.instanceGroup","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/bootstrap/pkibootstrap/pkiverifier/verifier.go","lineNumber":153,"sourceCode":"\t\tNamespace: \"kops-system\",\n\t\tName:      nodeName,\n\t}\n\tvar host kops.Host\n\tif err := v.client.Get(ctx, id, &host); err != nil {\n\t\tif apierrors.IsNotFound(err) {\n\t\t\treturn nil, nil, fmt.Errorf(\"host not found for %v\", id)\n\t\t}\n\t\treturn nil, nil, fmt.Errorf(\"error getting host %v: %w\", id, err)\n\t}\n\n\t// TODO: Check instance-group matches request (does it matter?)\n\n\tif host.Spec.PublicKey == \"\" {\n\t\treturn nil, nil, fmt.Errorf(\"host %v did not have public-key\", id)\n\t}\n\tinstanceGroup := host.Spec.InstanceGroup\n\tif instanceGroup == \"\" {\n\t\treturn nil, nil, fmt.Errorf(\"host %v did not have spec.instanceGroup\", id)\n\t}\n\tpubKey, err := pki.ParsePEMPublicKey([]byte(host.Spec.PublicKey))\n\tif err != nil {\n\t\treturn nil, nil, fmt.Errorf(\"failed to parse public key: %w\", err)\n\t}\n\n\tvar sans []string\n\n\tresult := &bootstrap.VerifyResult{\n\t\tNodeName:          nodeName,\n\t\tInstanceGroupName: instanceGroup,\n\t\tCertificateNames:  sans,\n\t}\n\n\treturn result, pubKey.Key, nil\n}\n\nfunc verifySignature(signingKey crypto.PublicKey, payload []byte, signature []byte) bool {","sourceCodeStart":135,"sourceCodeEnd":171,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/pkg/bootstrap/pkibootstrap/pkiverifier/verifier.go#L135-L171","documentation":"The Host object exists and has a public key, but spec.instanceGroup is empty. The verifier needs the instance group to include in the VerifyResult (used later for authorization of what certificates/roles the node may receive), so it rejects the request.","triggerScenarios":"VerifyToken -> getSigningKey fetches a Host where host.Spec.InstanceGroup == \"\" — the Host manifest omitted spec.instanceGroup or the reconciling controller never populated it.","commonSituations":"Manually authored Host YAML missing the instanceGroup field; copy of Host from a different cluster/version where the field was named differently; automation bug creating Hosts before group assignment; CRD schema change between kops versions dropping the value.","solutions":["Set spec.instanceGroup on the Host to the node's actual instance group (e.g. nodes, master-az1) and retry bootstrap","Check kubectl get host <name> -n kops-system -o yaml to see whether the field was dropped by validation or automation","Fix the tooling that creates Host objects so it always sets instanceGroup","Confirm you are on a kops version whose Host CRD contains the instanceGroup field"],"exampleFix":"// before\n// spec:\n//   publicKey: ...\n\n// after\n// spec:\n//   publicKey: ...\n//   instanceGroup: nodes","handlingStrategy":"validation","validationCode":"var host kops.Host\nif err := c.Get(ctx, types.NamespacedName{Namespace: \"kops-system\", Name: nodeName}, &host); err != nil {\n    return err\n}\nif host.Spec.InstanceGroup == \"\" {\n    return fmt.Errorf(\"Host %s must have spec.instanceGroup set before bootstrap\", nodeName)\n}","typeGuard":"func hostHasInstanceGroup(h *kops.Host) bool {\n    return h != nil && strings.TrimSpace(h.Spec.InstanceGroup) != \"\"\n}","tryCatchPattern":"result, err := verifier.VerifyToken(ctx, req, token, body)\nif err != nil {\n    if strings.Contains(err.Error(), \"did not have spec.instanceGroup\") {\n        return fmt.Errorf(\"set Host spec.instanceGroup for %s and retry\", nodeName)\n    }\n    return err\n}","preventionTips":["Always set spec.instanceGroup when creating Host objects","Cross-check instanceGroup against the cluster's InstanceGroup list for validity","Add schema-level validation (CRD required field) where possible","Verify field names against your kops version's Host API (v1alpha2)"],"tags":["kubernetes","configuration","missing-field","bootstrap"],"backgroundTag":"missing-required-argument","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T12:17:11.808Z"}