kubernetes/kops · error

empty subscription ID

Error message

empty subscription ID

What it means

Same bootstrap path as the resource-group check: metadata loaded fine but SubscriptionID is blank. The Azure SDK clients require a subscription ID, so the verifier returns this sentinel error instead of constructing invalid clients.

Source

Thrown at upup/pkg/fi/cloudup/azure/verifier.go:302

	subscriptionID string
	resourceGroup  string
	nisClient      *network.InterfacesClient
	vmsClient      *compute.VirtualMachinesClient
	vmssVMsClient  *compute.VirtualMachineScaleSetVMsClient
}

// newVerifierClient builds Azure API clients scoped to the local instance's subscription and
// resource group from IMDS metadata.
func newVerifierClient(ctx context.Context) (*client, error) {
	metadata, err := azuremetadata.QueryComputeInstanceMetadata(ctx)
	if err != nil || metadata == nil {
		return nil, fmt.Errorf("getting instance metadata: %w", err)
	}
	if metadata.ResourceGroupName == "" {
		return nil, fmt.Errorf("empty resource group name")
	}
	if metadata.SubscriptionID == "" {
		return nil, fmt.Errorf("empty subscription ID")
	}
	klog.V(4).Infof("Azure verifier client using subscription %q resource group %q", metadata.SubscriptionID, metadata.ResourceGroupName)

	cred, err := azidentity.NewDefaultAzureCredential(nil)
	if err != nil {
		return nil, fmt.Errorf("creating an identity: %w", err)
	}

	nisClient, err := network.NewInterfacesClient(metadata.SubscriptionID, cred, nil)
	if err != nil {
		return nil, fmt.Errorf("creating interfaces client: %w", err)
	}
	vmsClient, err := compute.NewVirtualMachinesClient(metadata.SubscriptionID, cred, nil)
	if err != nil {
		return nil, fmt.Errorf("creating VMs client: %w", err)
	}
	vmssVMsClient, err := compute.NewVirtualMachineScaleSetVMsClient(metadata.SubscriptionID, cred, nil)
	if err != nil {

View on GitHub (pinned to 4c8573c808)

Solutions

1. Verify subscriptionId in IMDS: curl -H Metadata:true 'http://169.254.169.254/metadata/instance/compute?api-version=2021-02-01' | jq .subscriptionId
2. Bypass any HTTP(S)_PROXY or custom metadata endpoint overrides on the node
3. Confirm the node VM is deployed under a valid subscription and IMDS api-version is current
4. If in unit tests, populate the fake metadata struct's SubscriptionID before calling newVerifierClient

m, err := azuremetadata.QueryComputeInstanceMetadata(ctx)
if err == nil && m != nil && m.SubscriptionID == "" {
	return fmt.Errorf("IMDS returned empty subscriptionId")
}

_, err := newVerifierClient(ctx)
if err != nil && strings.Contains(err.Error(), "empty subscription ID") {
	// environment problem: check IMDS response before retrying
}

When it happens

Trigger: QueryComputeInstanceMetadata returns metadata with SubscriptionID == "" — metadata response missing compute.subscriptionId, or a stubbed metadata source in tests/local runs.

Common situations: Non-Azure environment running verifier code; IMDS proxied/stubbed with incomplete JSON; extremely old metadata API version; corruption of IMDS response fields by middleboxes.

Related errors

• empty subscription ID
• getting instance metadata: %w
• empty resource group name
• failed to load AWS config: %w
• failed to get local-ipv4 address from ec2 metadata: %w

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/07cbac992dba4809. Report an issue: GitHub.