kubernetes/kops · error

empty subscription ID

Error message

empty subscription ID

What it means

newClient queries the Azure Instance Metadata Service (IMDS) to learn which subscription the node belongs to. If the metadata response returns successfully but SubscriptionID is an empty string, the client cannot be constructed, so this error is thrown. It indicates an IMDS response that is structurally valid but missing the subscription field.

Source

Thrown at pkg/nodeidentity/azure/client.go:46

)

// client is an Azure client.
type client struct {
	subscriptionID string
	vmClient       *compute.VirtualMachinesClient
	vmssClient     *compute.VirtualMachineScaleSetVMsClient
}

// newClient returns a new Client.
func newClient() (*client, error) {
	// nodeidentity.Identifier.New does not propagate a context; the IMDS HTTP client's own timeout
	// bounds this call.
	metadata, err := azuremetadata.QueryComputeInstanceMetadata(context.TODO())
	if err != nil {
		return nil, fmt.Errorf("error querying instance metadata: %s", err)
	}
	if metadata.SubscriptionID == "" {
		return nil, fmt.Errorf("empty subscription ID")
	}

	cred, err := azidentity.NewDefaultAzureCredential(nil)
	if err != nil {
		return nil, fmt.Errorf("creating identity: %w", err)
	}

	vmClient, err := compute.NewVirtualMachinesClient(metadata.SubscriptionID, cred, nil)
	if err != nil {
		return nil, fmt.Errorf("creating VMs client: %w", err)
	}

	vmssClient, err := compute.NewVirtualMachineScaleSetVMsClient(metadata.SubscriptionID, cred, nil)
	if err != nil {
		return nil, fmt.Errorf("creating VMSS VMs client: %w", err)
	}

	return &client{

View on GitHub (pinned to 4c8573c808)

Solutions

1. Verify the workload is actually running on an Azure VM or VMSS with IMDS reachable at 169.254.169.254
2. Curl the IMDS endpoint and inspect the JSON: curl -H Metadata:true 'http://169.254.169.254/metadata/instance/compute?api-version=2021-02-01' to confirm subscriptionId is present
3. If running off-cluster/off-Azure, run nodeidentity only on Azure nodes; it is not designed for non-Azure environments
4. Check for IMDS-blocking or IMDS-mutating network appliances/proxies and exclude 169.254.169.254 from them

Example fix

// debug before creating client
metadata, err := azuremetadata.QueryComputeInstanceMetadata(context.TODO())
if err != nil {
    return nil, fmt.Errorf("error querying instance metadata: %s", err)
}
// after (add diagnostics to pinpoint empty response)
if metadata.SubscriptionID == "" {
    return nil, fmt.Errorf("empty subscription ID (IMDS returned metadata without subscriptionId; is this an Azure VM?)")
}

if metadata.SubscriptionID == "" {
    return fmt.Errorf("IMDS metadata has no subscription ID; not running on an Azure VM?")
}

if err != nil {
    if strings.Contains(err.Error(), "empty subscription ID") {
        // treat as non-Azure or degraded IMDS; skip node identity lookup
    }
}

When it happens

Trigger: azuremetadata.QueryComputeInstanceMetadata returns a response whose SubscriptionID field is empty — e.g. the IMDS endpoint replied but the subscriptionId attribute was absent or blank.

Common situations: Running kops node code outside an Azure VM (IMDS is reachable only from Azure infrastructure), IMDS proxied/mocked or returning degraded data, unusual networking setups (custom metadata proxies, nested virtualization) that return partial payloads, or interception by security appliances that strip fields.

Related errors

• getting instance metadata: %w
• empty resource group name
• empty subscription ID
• failed to load AWS config: %w
• failed to get local-ipv4 address from ec2 metadata: %w

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/3928f2b617e1ca04. Report an issue: GitHub.