kubernetes/kops · error

determining IP configurations for %s network interface

Error message

determining IP configurations for %s network interface

What it means

privateIPEndpoints inspects a network interface's Properties.IPConfigurations to collect private IPs and nodeup challenge endpoints. If the interface's Properties block is nil, the IP configurations cannot be read and the error is returned, aborting endpoint discovery for the node.

Source

Thrown at upup/pkg/fi/cloudup/azure/verifier.go:270

	if osProfile == nil || osProfile.ComputerName == nil || *osProfile.ComputerName == "" {
		return "", "", fmt.Errorf("determining ComputerName for %s", desc)
	}

	nodeName = strings.ToLower(*osProfile.ComputerName)
	igNameTag, ok := tags[InstanceGroupNameTag]
	if !ok || igNameTag == nil {
		return "", "", fmt.Errorf("determining IG name for %s", desc)
	}
	klog.V(4).Infof("Azure verifier for %s resolved identity: node=%q instanceGroup=%q", desc, nodeName, *igNameTag)

	return nodeName, *igNameTag, nil
}

// privateIPEndpoints collects the private IP addresses and nodeup challenge endpoints from a
// network interface's IP configurations.
func privateIPEndpoints(ni network.Interface, desc string) (addrs, challengeEndpoints []string, err error) {
	if ni.Properties == nil {
		return nil, nil, fmt.Errorf("determining IP configurations for %s network interface", desc)
	}

	for _, ipc := range ni.Properties.IPConfigurations {
		if ipc.Properties != nil && ipc.Properties.PrivateIPAddress != nil {
			addrs = append(addrs, *ipc.Properties.PrivateIPAddress)
			challengeEndpoints = append(challengeEndpoints, net.JoinHostPort(*ipc.Properties.PrivateIPAddress, strconv.Itoa(wellknownports.NodeupChallenge)))
		}
	}
	return addrs, challengeEndpoints, nil
}

// client is an Azure client.
type client struct {
	subscriptionID string
	resourceGroup  string
	nisClient      *network.InterfacesClient
	vmsClient      *compute.VirtualMachinesClient
	vmssVMsClient  *compute.VirtualMachineScaleSetVMsClient

View on GitHub (pinned to 4c8573c808)

Solutions

1. Check the NIC exists: az network nic show -g rg -n <nic> and that it has ipConfigurations with a privateIPAddress
2. If the NIC was deleted, recreate it / re-run kops update so the VM's NIC is restored
3. Retry verification — a transient partial response will usually succeed on retry
4. If in tests, populate mock Interface.Properties.IPConfigurations with a PrivateIPAddress

ni, err := nisClient.Get(ctx, rg, nicName, nil)
if err != nil { return err }
if ni.Properties == nil || len(ni.Properties.IPConfigurations) == 0 {
	return fmt.Errorf("NIC %s has no IP configurations", nicName)
}

func hasIPConfigs(ni network.Interface) bool {
	return ni.Properties != nil && len(ni.Properties.IPConfigurations) > 0
}

ips, eps, err := privateIPEndpoints(ni, desc)
if err != nil {
	// NIC deleted or empty: check the NIC exists, then retry or fail verification
}

When it happens

Trigger: During VerifyToken the verifier Gets the NIC for the claiming VM; the returned network.Interface has Properties == nil (nil deref guard), so privateIPEndpoints errors immediately.

Common situations: NIC deleted/detached between VM listing and Get (deleted NIC returns empty object); a stubbed/mock network client returns an empty Interface; SDK response partial on throttling; NIC created manually without IP configurations.

Related errors

• fetching intermediate certificate from %s: %w
• reading intermediate certificate from %s: %w
• querying instance metadata: %w
• querying IMDS %s: %w
• reading IMDS response: %w

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/a483d9c08af9aa04. Report an issue: GitHub.