kubernetes/kops · error

challenge.secret not set

Error message

challenge.secret not set

What it means

DoCallbackChallenge validates that the Challenge struct passed in is fully populated before it attempts the gRPC callback to kops-controller. The ChallengeSecret is the HMAC key material used to build the expected challenge response; an empty slice means the node's bootstrap configuration did not carry the secret issued during the challenge handshake. The library refuses to proceed with an incomplete challenge rather than sending a request that would certainly fail verification.

Source

Thrown at pkg/bootstrap/challenge_client.go:77

	clientCertificate := &tls.Certificate{
		PrivateKey:  privateKey.Key,
		Certificate: [][]byte{certificate.Certificate.Raw},
		Leaf:        certificate.Certificate,
	}
	return clientCertificate, nil
}

func (c *ChallengeClient) DoCallbackChallenge(ctx context.Context, clusterName string, targetEndpoint string, bootstrapRequest *nodeup.BootstrapRequest) error {
	challenge := bootstrapRequest.Challenge

	if challenge == nil {
		return fmt.Errorf("challenge not set")
	}
	if challenge.ChallengeID == "" {
		return fmt.Errorf("challenge.id not set")
	}
	if len(challenge.ChallengeSecret) == 0 {
		return fmt.Errorf("challenge.secret not set")
	}
	if challenge.Endpoint == "" {
		return fmt.Errorf("challenge.endpoint not set")
	}
	if len(challenge.ServerCA) == 0 {
		return fmt.Errorf("challenge.ca not set")
	}

	clientCertificate, err := c.getClientCertificate(ctx, clusterName)
	if err != nil {
		return err
	}

	serverCAs := x509.NewCertPool()
	if !serverCAs.AppendCertsFromPEM(challenge.ServerCA) {
		return fmt.Errorf("error loading certificate pool")
	}

View on GitHub (pinned to 4c8573c808)

Solutions

1. Populate Challenge.ChallengeSecret with the secret bytes returned by the kops-controller challenge before calling DoCallbackChallenge
2. Re-run the bootstrap/challenge flow to obtain a fresh complete Challenge object
3. Check the code path that constructs the Challenge struct and ensure ChallengeSecret is copied from the stored challenge data

Example fix

// before
ch := &bootstrap.Challenge{ChallengeID: id, Endpoint: ep, ServerCA: ca}
err := client.DoCallbackChallenge(ctx, clusterName, ch)
// after
ch := &bootstrap.Challenge{ChallengeID: id, ChallengeSecret: secret, Endpoint: ep, ServerCA: ca}
err := client.DoCallbackChallenge(ctx, clusterName, ch)

if ch == nil || len(ch.ChallengeSecret) == 0 {
	return fmt.Errorf("challenge secret missing before DoCallbackChallenge")
}

if err := client.DoCallbackChallenge(ctx, clusterName, ch); err != nil {
	if strings.Contains(err.Error(), "challenge.secret not set") {
		// re-fetch/regenerate challenge before retrying
	}
	return err
}

When it happens

Trigger: Calling DoCallbackChallenge with a Challenge whose ChallengeSecret field is nil or a zero-length []byte, typically because the challenge data deserialized from the node bootstrap config (kubectl get/bootstrap source) was incomplete.

Common situations: A cluster spec or bootstrap configuration was hand-edited and the challenge secret dropped; a node was registered before the kops-controller issued the secret; a bug in code constructing the Challenge struct forgot to copy ChallengeSecret from the challenge response.

Understand the failure class

Background: "missing required argument" and "the following required arguments were not provided": what required-argument errors mean and how to fix them — this error's family across 20 libraries.

Related errors

• challenge.endpoint not set
• challenge.ca not set
• challenge not set
• challenge.id not set
• no instance group defined in nodeup config

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/4ab3f49cf824cfb1. Report an issue: GitHub.