kubernetes/kops · error

attested document subscriptionId is required

Error message

attested document subscriptionId is required

What it means

Guard on the unmarshalled attested document: subscriptionId is empty, so the attested subscription cannot be compared with the verifier's subscription for anti-replay-across-tenants protection. The signed payload is missing required identity data.

Source

Thrown at upup/pkg/fi/cloudup/azure/attest.go:288

// azuremetadata implementation keeps the authenticator and verifier sides identical.
func nonceForBody(body []byte) string {
	return azuremetadata.NonceForBody(body)
}

// parseAndValidateAttestedDocumentContent unmarshals the signed attestation payload and validates
// its nonce and freshness timestamps.
func parseAndValidateAttestedDocumentContent(content []byte, body []byte) (*attestedData, error) {
	var data attestedData
	if err := json.Unmarshal(content, &data); err != nil {
		return nil, fmt.Errorf("unmarshalling attested data: %w", err)
	}
	klog.V(4).Infof("Attested document content: vmId=%q subscriptionId=%q createdOn=%q expiresOn=%q", data.VMId, data.SubscriptionId, data.TimeStamp.CreatedOn, data.TimeStamp.ExpiresOn)

	if data.VMId == "" {
		return nil, fmt.Errorf("attested document vmId is required")
	}
	if data.SubscriptionId == "" {
		return nil, fmt.Errorf("attested document subscriptionId is required")
	}

	// Verify the nonce matches the request body hash (replay protection).
	expectedNonce := nonceForBody(body)
	if data.Nonce != expectedNonce {
		return nil, fmt.Errorf("attested document nonce mismatch: got=%q expected=%q", data.Nonce, expectedNonce)
	}

	now := time.Now().UTC()
	if data.TimeStamp.CreatedOn == "" {
		return nil, fmt.Errorf("attested document createdOn is required")
	}
	createdOn, err := time.Parse(attestedDocumentTimeFormat, data.TimeStamp.CreatedOn)
	if err != nil {
		return nil, fmt.Errorf("parsing attested document creation: %w", err)
	}
	if createdOn.After(now.Add(attestedDocumentMaxClockSkew)) {
		return nil, fmt.Errorf("attested document createdOn %s is too far in the future", data.TimeStamp.CreatedOn)

View on GitHub (pinned to 4c8573c808)

Solutions

1. Reject the attestation token
2. Regenerate the token on the node
3. Update kOps if Azure changed the attested document fields

When it happens

Trigger: Thrown at upup/pkg/fi/cloudup/azure/attest.go:288 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/9a8703b48fa1e7a8. Report an issue: GitHub.