kubernetes/kops · error

challenge.endpoint not set

Error message

challenge.endpoint not set

What it means

DoCallbackChallenge requires a non-empty Endpoint: the host:port of the kops-controller callback server it must dial over gRPC. An empty Endpoint means the challenge configuration is incomplete, so the client cannot know where to send the challenge response and fails fast during validation.

Source

Thrown at pkg/bootstrap/challenge_client.go:80

		Leaf:        certificate.Certificate,
	}
	return clientCertificate, nil
}

func (c *ChallengeClient) DoCallbackChallenge(ctx context.Context, clusterName string, targetEndpoint string, bootstrapRequest *nodeup.BootstrapRequest) error {
	challenge := bootstrapRequest.Challenge

	if challenge == nil {
		return fmt.Errorf("challenge not set")
	}
	if challenge.ChallengeID == "" {
		return fmt.Errorf("challenge.id not set")
	}
	if len(challenge.ChallengeSecret) == 0 {
		return fmt.Errorf("challenge.secret not set")
	}
	if challenge.Endpoint == "" {
		return fmt.Errorf("challenge.endpoint not set")
	}
	if len(challenge.ServerCA) == 0 {
		return fmt.Errorf("challenge.ca not set")
	}

	clientCertificate, err := c.getClientCertificate(ctx, clusterName)
	if err != nil {
		return err
	}

	serverCAs := x509.NewCertPool()
	if !serverCAs.AppendCertsFromPEM(challenge.ServerCA) {
		return fmt.Errorf("error loading certificate pool")
	}

	serverName := challengeServerHostName(clusterName)
	tlsConfig := &tls.Config{
		RootCAs:      serverCAs,

View on GitHub (pinned to 4c8573c808)

Solutions

1. Set Challenge.Endpoint to the kops-controller callback address (e.g. <name>.internal.<cluster>) before calling DoCallbackChallenge
2. Regenerate the challenge/bootstrap config so the controller endpoint is included
3. Verify the cluster configuration includes the correct kops-controller service address

Example fix

// before
ch := &bootstrap.Challenge{ChallengeID: id, ChallengeSecret: secret, ServerCA: ca}
// after
ch := &bootstrap.Challenge{ChallengeID: id, ChallengeSecret: secret, Endpoint: "kops-controller.internal.example.cluster", ServerCA: ca}

if ch == nil || ch.Endpoint == "" {
	return fmt.Errorf("challenge endpoint missing before DoCallbackChallenge")
}

if err := client.DoCallbackChallenge(ctx, clusterName, ch); err != nil {
	if strings.Contains(err.Error(), "challenge.endpoint not set") {
		// resolve kops-controller address and rebuild challenge
	}
	return err
}

When it happens

Trigger: Calling DoCallbackChallenge with a Challenge whose Endpoint field is the empty string — the callback server address was never populated in the challenge config.

Common situations: The kops-controller endpoint was not recorded in the node bootstrap configuration; cluster DNS/service discovery misconfiguration left the controller address blank; hand-built Challenge structs omitting Endpoint.

Understand the failure class

Background: "missing required argument" and "the following required arguments were not provided": what required-argument errors mean and how to fix them — this error's family across 20 libraries.

Related errors

• challenge.secret not set
• challenge.ca not set
• challenge not set
• challenge.id not set
• no instance group defined in nodeup config

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/cf624b00c1303ca8. Report an issue: GitHub.