kubernetes/kops · error

attested document vmId is required

Error message

attested document vmId is required

What it means

Guard on the unmarshalled attested document: the vmId field is empty, so the document does not identify a VM and identity resolution cannot proceed. The signed payload is missing required identity data.

Source

Thrown at upup/pkg/fi/cloudup/azure/attest.go:285

}

// nonceForBody derives the IMDS attestation nonce from the request body; the shared
// azuremetadata implementation keeps the authenticator and verifier sides identical.
func nonceForBody(body []byte) string {
	return azuremetadata.NonceForBody(body)
}

// parseAndValidateAttestedDocumentContent unmarshals the signed attestation payload and validates
// its nonce and freshness timestamps.
func parseAndValidateAttestedDocumentContent(content []byte, body []byte) (*attestedData, error) {
	var data attestedData
	if err := json.Unmarshal(content, &data); err != nil {
		return nil, fmt.Errorf("unmarshalling attested data: %w", err)
	}
	klog.V(4).Infof("Attested document content: vmId=%q subscriptionId=%q createdOn=%q expiresOn=%q", data.VMId, data.SubscriptionId, data.TimeStamp.CreatedOn, data.TimeStamp.ExpiresOn)

	if data.VMId == "" {
		return nil, fmt.Errorf("attested document vmId is required")
	}
	if data.SubscriptionId == "" {
		return nil, fmt.Errorf("attested document subscriptionId is required")
	}

	// Verify the nonce matches the request body hash (replay protection).
	expectedNonce := nonceForBody(body)
	if data.Nonce != expectedNonce {
		return nil, fmt.Errorf("attested document nonce mismatch: got=%q expected=%q", data.Nonce, expectedNonce)
	}

	now := time.Now().UTC()
	if data.TimeStamp.CreatedOn == "" {
		return nil, fmt.Errorf("attested document createdOn is required")
	}
	createdOn, err := time.Parse(attestedDocumentTimeFormat, data.TimeStamp.CreatedOn)
	if err != nil {
		return nil, fmt.Errorf("parsing attested document creation: %w", err)

View on GitHub (pinned to 4c8573c808)

Solutions

1. Reject the attestation token
2. Regenerate the token on the node so a complete document is produced
3. Update kOps if the document format changed

When it happens

Trigger: Thrown at upup/pkg/fi/cloudup/azure/attest.go:285 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/19c8fdefbc9cb43d. Report an issue: GitHub.