kubernetes/kops · error

cannot determine challenge endpoint for instance id: %s

Error message

cannot determine challenge endpoint for instance id: %s

What it means

Once instance data is fetched, VerifyToken derives the challenge endpoints from the instance's IPv4 addresses via gatherIPv4Addresses(instance.IPv4). To verify the node actually runs on the claimed Linode, it must challenge at least one routable IPv4 endpoint. If none exist (instance has no public or usable IPv4), verification cannot proceed and this error names the instance ID.

Source

Thrown at upup/pkg/fi/cloudup/linode/verifier.go:85

	}

	instanceIDString := strings.TrimPrefix(token, linodemetadata.LinodeAuthenticationTokenPrefix)
	instanceID, err := strconv.Atoi(instanceIDString)
	if err != nil {
		return nil, fmt.Errorf("invalid authorization token")
	}

	instance, err := v.client.GetInstance(ctx, instanceID)
	if err != nil {
		return nil, fmt.Errorf("failed to get info for Akamai (Linode) instance %q: %w", instanceIDString, err)
	}
	if instance == nil {
		return nil, fmt.Errorf("failed to get info for Akamai (Linode) instance %q: empty response", instanceIDString)
	}

	addresses, challengeEndpoints := gatherIPv4Addresses(instance.IPv4)
	if len(challengeEndpoints) == 0 {
		return nil, fmt.Errorf("cannot determine challenge endpoint for instance id: %s", instanceIDString)
	}

	result := &bootstrap.VerifyResult{
		NodeName:          instance.Label,
		InstanceGroupName: instanceGroupNameFromTags(instance.Tags),
		CertificateNames:  addresses,
		ChallengeEndpoint: challengeEndpoints[0],
	}

	return result, nil
}

// gatherIPv4Addresses returns a list of IPv4 addresses and challenge endpoints from the given list of IPs.
func gatherIPv4Addresses(ips []net.IP) ([]string, []string) {
	addresses := make([]string, 0, len(ips))
	challengeEndpoints := make([]string, 0, len(ips))

	for _, ip := range ips {

View on GitHub (pinned to 4c8573c808)

Solutions

1. Attach a public IPv4 address (or at least an address reachable by the verifier) to the Linode instance
2. If private-only networking is intentional, ensure the verifier can reach the instance's private IPv4 and that gatherIPv4Addresses includes private ranges for your setup
3. Re-check instance.Networking/IPv4 via the Linode API to confirm what addresses exist
4. Adjust kOps cluster config to require a public interface for verified instances

Example fix

// before (instance config)
interfaces: [{purpose: "vlan"}]
// after (instance config)
interfaces: [{purpose: "public"}, {purpose: "vlan"}]

addrs, challenges := gatherIPv4Addresses(instance.IPv4)
if len(challenges) == 0 {
	return fmt.Errorf("instance %s has no challengeable IPv4; attach a public interface", instance.Label)
}

result, err := verifier.VerifyToken(ctx, token, certs, challenge)
if err != nil {
	if strings.Contains(err.Error(), "cannot determine challenge endpoint") {
		return fmt.Errorf("ensure the Linode has a public IPv4 before bootstrapping: %w", err)
	}
	return err
}

When it happens

Trigger: gatherIPv4Addresses returns len(challengeEndpoints) == 0 — the Linode instance has no public IPv4 addresses (IPv4-only disabled / private-only networking), or IPv4 list is empty/nil in the API response. Exercised by TestLinodeVerifierVerifyTokenNoPrivateIP.

Common situations: Instances provisioned with only private/VLAN networking and no public IP; Linode configurations where public interface was removed; region/account configs with IPv4 allocation disabled; IPv6-only instances.

Related errors

• failed to find load-balancer %q public address
• error listing Akamai (Linode) interfaces for instance %q: %w
• error building linode node identifier: %w
• error disabling swap: %v
• failed to read %s: %w

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/603f26670483774b. Report an issue: GitHub.