kubernetes/kops · error

determining IG name for %s

Error message

determining IG name for %s

What it means

The verifier resolves which instance group a node belongs to by reading the kops InstanceGroupNameTag off the VM's Azure tags. If the tag is missing or nil, node identity cannot be completed and token verification is rejected.

Source

Thrown at upup/pkg/fi/cloudup/azure/verifier.go:259

func extractNodeIdentity(data *attestedData, desc string, apiVMID *string, osProfile *compute.OSProfile, tags map[string]*string) (nodeName, igName string, err error) {
	if apiVMID == nil {
		return "", "", fmt.Errorf("determining VMID for %s", desc)
	}

	// Cross-verify: the vmId from the cryptographically signed attested document must match the vmId from the
	// Azure API for the claimed resource ID.
	klog.V(4).Infof("Azure verifier for %s cross-verifying vmId: attested=%q api=%q", desc, data.VMId, *apiVMID)
	if data.VMId != *apiVMID {
		return "", "", fmt.Errorf("attested vmId %q does not match %s (API vmId %q)", data.VMId, desc, *apiVMID)
	}
	if osProfile == nil || osProfile.ComputerName == nil || *osProfile.ComputerName == "" {
		return "", "", fmt.Errorf("determining ComputerName for %s", desc)
	}

	nodeName = strings.ToLower(*osProfile.ComputerName)
	igNameTag, ok := tags[InstanceGroupNameTag]
	if !ok || igNameTag == nil {
		return "", "", fmt.Errorf("determining IG name for %s", desc)
	}
	klog.V(4).Infof("Azure verifier for %s resolved identity: node=%q instanceGroup=%q", desc, nodeName, *igNameTag)

	return nodeName, *igNameTag, nil
}

// privateIPEndpoints collects the private IP addresses and nodeup challenge endpoints from a
// network interface's IP configurations.
func privateIPEndpoints(ni network.Interface, desc string) (addrs, challengeEndpoints []string, err error) {
	if ni.Properties == nil {
		return nil, nil, fmt.Errorf("determining IP configurations for %s network interface", desc)
	}

	for _, ipc := range ni.Properties.IPConfigurations {
		if ipc.Properties != nil && ipc.Properties.PrivateIPAddress != nil {
			addrs = append(addrs, *ipc.Properties.PrivateIPAddress)
			challengeEndpoints = append(challengeEndpoints, net.JoinHostPort(*ipc.Properties.PrivateIPAddress, strconv.Itoa(wellknownports.NodeupChallenge)))
		}

View on GitHub (pinned to 4c8573c808)

Solutions

1. Re-add the kops instance-group tag on the VM (kops-cloud-azure-instance-group-name style key) or run `kops update cluster --yes` / `kops rolling-update cluster` to restore managed tags
2. Check Azure Policy or tag governance that could block kops tags on resources
3. If the node was just created, wait/retry until kops tagged it, then restart the failed verification
4. Verify the node belongs to the cluster — nodes created outside kops will never carry the tag and cannot verify

Example fix

// before (VM missing tag)
$ az vm show -g rg -n node1 --query tags   # {} 
// after: restore via kops
$ kops update cluster --name mycluster --yes   # re-applies kops tags to Azure VMs

vm, err := vmsClient.Get(ctx, rg, name, nil)
if err != nil { return err }
if v, ok := vm.Tags[cloudtags.InstanceGroupNameTag]; !ok || v == nil || *v == "" {
	return fmt.Errorf("VM %s missing kops instance-group tag %s", name, cloudtags.InstanceGroupNameTag)
}

func hasIGTag(vm *compute.VirtualMachine, tag string) bool {
	return vm != nil && vm.Tags != nil && vm.Tags[tag] != nil && *vm.Tags[tag] != ""
}

_, _, err := verifier.VerifyToken(ctx, token)
if err != nil && strings.Contains(err.Error(), "determining IG name") {
	// re-apply kops-managed tags (kops update cluster) before retrying
}

When it happens

Trigger: The VM's tags map lacks the InstanceGroupNameTag key, or the tag value pointer is nil, after a successful Get of the VM in extractNodeIdentity.

Common situations: Someone edited/removed kops-managed tags in the Azure portal; VM was created outside kops (e.g. manually or via VMSS reimage losing tags); tag propagation delay right after instance creation; a tag policy/azure policy stripped custom tags.

Related errors

• building tags for %q: %w
• DeleteGroup not implemented on azureCloud
• error parsing Kubernetes version %q: %v
• cannot find subnet %q (declared in instance group %q, not fo
• InstanceGroup #%d did not have a Name

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/7f66b7cdb820f85b. Report an issue: GitHub.