cannot determine challenge endpoint for instance id: %s

Error message

cannot determine challenge endpoint for instance id: %s

What it means

After identifying the bootstrapping instance, the verifier builds the list of challenge endpoints (IP:port where nodeup listens for cert challenges) from every private IPv4 and IPv6 address on the instance's ENIs, using wellknownports.NodeupChallenge. If the instance's network interfaces expose no private IP addresses at all, there is no endpoint to reach nodeup on, so verification fails.

Source

Thrown at pkg/bootstrap/awsbootstrap/verifier.go:334

	for _, nic := range instance.NetworkInterfaces {
		if ip := aws.ToString(nic.PrivateIpAddress); ip != "" {
			challengeEndpoints = append(challengeEndpoints, net.JoinHostPort(ip, strconv.Itoa(wellknownports.NodeupChallenge)))
		}
		for _, a := range nic.PrivateIpAddresses {
			if ip := aws.ToString(a.PrivateIpAddress); ip != "" {
				challengeEndpoints = append(challengeEndpoints, net.JoinHostPort(ip, strconv.Itoa(wellknownports.NodeupChallenge)))
			}
		}

		for _, a := range nic.Ipv6Addresses {
			if ip := aws.ToString(a.Ipv6Address); ip != "" {
				challengeEndpoints = append(challengeEndpoints, net.JoinHostPort(ip, strconv.Itoa(wellknownports.NodeupChallenge)))
			}
		}
	}

	if len(challengeEndpoints) == 0 {
		return nil, fmt.Errorf("cannot determine challenge endpoint for instance id: %s", instanceID)
	}

	nodeName := addrs[0]
	if a.opt.UseIPBasedNodeNames {
		// Derive the node name with the same formula nodeup uses, so that the certificates are
		// issued for the exact name the node registers with, whatever the VPC DNS configuration.
		privateIPv4 := aws.ToString(instance.PrivateIpAddress)
		if privateIPv4 == "" {
			return nil, fmt.Errorf("instance %q has no private IPv4 address", instanceID)
		}
		nodeName = PrivateDNSName(privateIPv4, a.opt.Region)
		if !slices.Contains(addrs, nodeName) {
			addrs = append(addrs, nodeName)
		}
	}

	result := &bootstrap.VerifyResult{
		NodeName:          nodeName,

View on GitHub (pinned to 4c8573c808)

Solutions

Wait for the instance to fully initialize and retry verification; ENI private IPs may not have been reported at DescribeInstances time.
Check the instance's ENIs in the AWS console/CLI (aws ec2 describe-network-interfaces) to confirm each has a primary private IPv4 address.
Ensure the node uses standard VPC networking with a primary ENI that has a private IP; reattach/replace broken ENIs.
If using IP-based node names, also confirm Ipv6Addresses or private IPv4s exist on at least one interface.

Defensive patterns

Strategy: validation

Validate before calling

out, _ := ec2Client.DescribeInstances(ctx, &ec2.DescribeInstancesInput{InstanceIds: []string{instanceID}})
inst, ok := exactlyOneInstance(out)
if !ok { return fmt.Errorf("instance %s not found", instanceID) }
hasAddr := false
for _, nic := range inst.NetworkInterfaces {
  if aws.ToString(nic.PrivateIpAddress) != "" || len(nic.PrivateIpAddresses) > 0 || len(nic.Ipv6Addresses) > 0 {
    hasAddr = true
  }
}
if !hasAddr { return fmt.Errorf("instance %s has no private addresses yet; wait for ENI attach", instanceID) }

Type guard

func hasChallengeEndpoint(inst types.Instance) bool {
  for _, nic := range inst.NetworkInterfaces {
    if aws.ToString(nic.PrivateIpAddress) != "" { return true }
    if len(nic.PrivateIpAddresses) > 0 || len(nic.Ipv6Addresses) > 0 { return true }
  }
  return false
}

Try / catch

result, err := verifier.VerifyToken(ctx, token)
if err != nil && strings.Contains(err.Error(), "cannot determine challenge endpoint") {
  // wait for ENI addresses to populate, then retry
  time.Sleep(10 * time.Second)
  return verifier.VerifyToken(ctx, token)
}

Prevention

Wait for the instance to reach running/fully-initialized state before requesting bootstrap verification.
Verify ENIs have primary private IPs via aws ec2 describe-network-interfaces before bootstrapping.
Avoid custom networking that strips private IPs from the primary ENI.

When it happens

Trigger: verifyCallerIdentity (via verifyTokenV1/verifyTokenV2) iterates instance.NetworkInterfaces and finds no non-empty nic.PrivateIpAddress, no PrivateIpAddresses entries, and no Ipv6Addresses — challengeEndpoints stays empty.

Common situations: Instance still initializing so ENI addresses aren't attached/reported yet; an ENI in a weird state (pending attach); instances launched with unusual networking (e.g. custom CNI removing primary private IP); a stale EC2 response from a caching layer.

Related errors

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/61ef4fe6de01cf49. Report an issue: GitHub.