authentication request address %q does not match server addr

Error message

authentication request address %q does not match server addresses %v

What it means

The source IP of the bootstrap request does not match any address of the server named in the token. This is the core anti-spoofing check: only the instance itself should be able to present its token, so a request from an unrelated address is rejected.

Source

Thrown at upup/pkg/fi/cloudup/openstack/verifier.go:154

	var addresses map[string][]Address
	err = mapstructure.Decode(instance.Addresses, &addresses)
	if err != nil {
		return nil, fmt.Errorf("unable to decode addresses: %w", err)
	}

	for _, addrList := range addresses {
		for _, props := range addrList {
			addrs = append(addrs, props.Addr)
		}
	}
	// ensure that request is coming from same machine
	requestAddr, _, err := net.SplitHostPort(rawRequest.RemoteAddr)
	if err != nil {
		return nil, fmt.Errorf("invalid remote address %q: %v", rawRequest.RemoteAddr, err)
	}
	if !stringInSlice(requestAddr, addrs) {
		return nil, fmt.Errorf("authentication request address %q does not match server addresses %v", requestAddr, addrs)
	}

	// We will call back onto this address, now that we have verified it is an instance IP
	challengeEndpoint := net.JoinHostPort(requestAddr, strconv.Itoa(wellknownports.NodeupChallenge))

	// check from kubernetes API does the instance already exist
	_, err = o.kubeClient.CoreV1().Nodes().Get(ctx, instance.Name, v1.GetOptions{})
	if err == nil {
		return nil, bootstrap.ErrAlreadyExists
	}
	if err != nil && !errors.IsNotFound(err) {
		return nil, fmt.Errorf("got error while querying kubernetes api: %w", err)
	}

	result := &bootstrap.VerifyResult{
		NodeName:          instance.Name,
		CertificateNames:  addrs,
		ChallengeEndpoint: challengeEndpoint,

View on GitHub (pinned to 4c8573c808)

Solutions

Verify the request is not arriving via a NAT/proxy that changes the source address
Confirm the requester is the OpenStack instance named in the token
Check that the instance's addresses include the request's source IP

Defensive patterns

Strategy: validation

When it happens

Trigger: Thrown at upup/pkg/fi/cloudup/openstack/verifier.go:154 when the library encounters an invalid state.

Common situations: See trigger scenarios.

Understand the failure class

Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/8ecf9855062ddc8c. Report an issue: GitHub.