kubernetes/kops · error

determining certificate alternate names for node %q

Error message

determining certificate alternate names for node %q

What it means

Post-collection guard in VerifyToken: after gathering private IP endpoints for the node, at least one address is required to build the certificate SANs. Fires when the NIC/instance yielded no usable private IP addresses, so there is nothing to put in the node's TLS certificate alternate names.

Source

Thrown at upup/pkg/fi/cloudup/azure/verifier.go:221

		}

		// Collect private IP addresses from the VMSS VM's network interface.
		ni, err := a.client.nisClient.GetVirtualMachineScaleSetNetworkInterface(ctx, a.client.resourceGroup, vmssName, vmssIndex, vmssName, nil)
		if err != nil {
			return nil, fmt.Errorf("getting info for %s network interface: %w", desc, err)
		}
		addrs, challengeEndpoints, err = privateIPEndpoints(ni.Interface, desc)
		if err != nil {
			return nil, err
		}

	default:
		return nil, fmt.Errorf("unsupported resource type %q", resourceType)
	}

	// Validate that we found at least one address and challenge endpoint.
	if len(addrs) == 0 {
		return nil, fmt.Errorf("determining certificate alternate names for node %q", nodeName)
	}
	if len(challengeEndpoints) == 0 {
		return nil, fmt.Errorf("determining challenge endpoint for node %q", nodeName)
	}

	result := &bootstrap.VerifyResult{
		NodeName:          nodeName,
		InstanceGroupName: igName,
		CertificateNames:  addrs,
		ChallengeEndpoint: challengeEndpoints[0],
	}

	klog.V(2).Infof("Azure verifier for VM %q verified as node %q in instance group %q", vmLogID, nodeName, igName)
	return result, nil
}

// extractNodeIdentity cross-verifies the attested vmId against the Azure API vmId for the claimed resource and
// extracts the node name and instance group from the API object. desc is a human-readable resource description

View on GitHub (pinned to 4c8573c808)

Solutions

1. Check that the VM/VMSS instance has a NIC with an attached IP configuration holding a private IP
2. Ensure the IP configuration is not in a failed provisioning state
3. Re-run the bootstrap request once the instance networking is fully provisioned

When it happens

Trigger: Thrown at upup/pkg/fi/cloudup/azure/verifier.go:221 when the library encounters an invalid state.

Common situations: See trigger scenarios.

Understand the failure class

• SSL/TLS and certificate errors — how TLS handshakes and certificate validation fail.

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/7c9d3638cfd5e0b1. Report an issue: GitHub.