kubernetes/kops · error

attested subscriptionId %q does not match verifier subscript

Error message

attested subscriptionId %q does not match verifier subscription %q

What it means

After the PKCS7 attested document is cryptographically verified, the subscription ID inside the attested payload does not match the verifier's subscription. This means the signature is valid but the attested VM lives in a different subscription than the one kops-controller manages, indicating a cross-subscription credential or a re-used attestation token.

Source

Thrown at upup/pkg/fi/cloudup/azure/verifier.go:151

	}
	switch resourceType {
	case vmResourceType:
	case vmssVMResourceType:
		if !strings.HasSuffix(res.Parent.Name, "."+a.clusterName) {
			return nil, fmt.Errorf("resource ID VMSS name %q does not match cluster name %q", res.Parent.Name, a.clusterName)
		}
	default:
		return nil, fmt.Errorf("unsupported resource type %q", resourceType)
	}

	// Verify the PKCS7 attested document: signature, certificate chain, nonce, and expiration.
	data, err := a.attestation.verifyAttestedDocument(signature, body)
	if err != nil {
		return nil, err
	}
	klog.V(2).Infof("Azure verifier for VM %q verified attested document", vmLogID)
	if !strings.EqualFold(data.SubscriptionId, a.client.subscriptionID) {
		return nil, fmt.Errorf("attested subscriptionId %q does not match verifier subscription %q", data.SubscriptionId, a.client.subscriptionID)
	}

	// Look up the VM or VMSS VM via the Azure API using the resource ID, cross-verify the attested
	// vmId, and extract node identity.
	var nodeName, igName string
	var addrs, challengeEndpoints []string

	switch resourceType {
	case vmResourceType:
		vmName := res.Name
		desc := fmt.Sprintf("VM %q", vmName)
		klog.V(2).Infof("Azure verifier for VM %q looking up Azure API object", vmLogID)

		vm, err := a.client.vmsClient.Get(ctx, a.client.resourceGroup, vmName, nil)
		if err != nil {
			return nil, fmt.Errorf("getting info for %s: %w", desc, err)
		}
		if vm.Properties == nil {

View on GitHub (pinned to 4c8573c808)

Solutions

1. Confirm the attestation token was generated on a VM in the verifier's subscription
2. Check for replayed or cached attestation tokens from another deployment
3. Verify the cluster's Azure subscription configuration

When it happens

Trigger: Thrown at upup/pkg/fi/cloudup/azure/verifier.go:151 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/7ce3814cfaa7877e. Report an issue: GitHub.