kubernetes/kops · error

empty resource group name

Error message

empty resource group name

What it means

The IMDS compute metadata was retrieved but the ResourceGroupName field is empty. The verifier requires a resource group to scope its Network Interfaces and Virtual Machines clients, so it refuses to continue.

Source

Thrown at upup/pkg/fi/cloudup/azure/verifier.go:299

// client is an Azure client.
type client struct {
	subscriptionID string
	resourceGroup  string
	nisClient      *network.InterfacesClient
	vmsClient      *compute.VirtualMachinesClient
	vmssVMsClient  *compute.VirtualMachineScaleSetVMsClient
}

// newVerifierClient builds Azure API clients scoped to the local instance's subscription and
// resource group from IMDS metadata.
func newVerifierClient(ctx context.Context) (*client, error) {
	metadata, err := azuremetadata.QueryComputeInstanceMetadata(ctx)
	if err != nil || metadata == nil {
		return nil, fmt.Errorf("getting instance metadata: %w", err)
	}
	if metadata.ResourceGroupName == "" {
		return nil, fmt.Errorf("empty resource group name")
	}
	if metadata.SubscriptionID == "" {
		return nil, fmt.Errorf("empty subscription ID")
	}
	klog.V(4).Infof("Azure verifier client using subscription %q resource group %q", metadata.SubscriptionID, metadata.ResourceGroupName)

	cred, err := azidentity.NewDefaultAzureCredential(nil)
	if err != nil {
		return nil, fmt.Errorf("creating an identity: %w", err)
	}

	nisClient, err := network.NewInterfacesClient(metadata.SubscriptionID, cred, nil)
	if err != nil {
		return nil, fmt.Errorf("creating interfaces client: %w", err)
	}
	vmsClient, err := compute.NewVirtualMachinesClient(metadata.SubscriptionID, cred, nil)
	if err != nil {
		return nil, fmt.Errorf("creating VMs client: %w", err)

View on GitHub (pinned to 4c8573c808)

Solutions

1. Check IMDS output contains resourceGroupName: curl -H Metadata:true 'http://169.254.169.254/metadata/instance/compute?api-version=2021-02-01' | jq .resourceGroupName
2. Ensure the VM is a real Azure resource manager VM (not classic), which always populates resourceGroupName
3. Remove any IMDS proxy/override in the environment so real Azure metadata is returned
4. Recreate the node via kops if the VM was built with an unusual/unsupported image configuration

m, err := azuremetadata.QueryComputeInstanceMetadata(ctx)
if err == nil && m != nil && m.ResourceGroupName == "" {
	return fmt.Errorf("IMDS returned empty resourceGroupName; not running on a managed Azure VM?")
}

_, err := newVerifierClient(ctx)
if err != nil && strings.Contains(err.Error(), "empty resource group name") {
	// abort: wrong environment; don't retry blindly
}

When it happens

Trigger: QueryComputeInstanceMetadata succeeded but metadata.ResourceGroupName == "" — e.g. a non-VM context, a mocked/legacy metadata source, or metadata response lacking compute.resourceGroupName.

Common situations: Running the verifier binary off-cluster/off-Azure against a fake metadata endpoint; very old IMDS API versions that omit resourceGroupName; metadata service proxied to a generic response; typo in environment forcing an alternate metadata source.

Related errors

• empty subscription ID
• getting instance metadata: %w
• empty subscription ID
• failed to load AWS config: %w
• failed to get local-ipv4 address from ec2 metadata: %w

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/1590376886c40365. Report an issue: GitHub.