kubernetes/kops · error

getting info for %s: %w

Error message

getting info for %s: %w

What it means

The Azure API GET for the VM (or VMSS VM) described by the verified token failed while fetching its details. This is an infrastructure-level lookup failure after successful attestation, e.g. the VM was deleted between attestation and lookup, an authorization problem, or a transient Azure API error.

Source

Thrown at upup/pkg/fi/cloudup/azure/verifier.go:167

	klog.V(2).Infof("Azure verifier for VM %q verified attested document", vmLogID)
	if !strings.EqualFold(data.SubscriptionId, a.client.subscriptionID) {
		return nil, fmt.Errorf("attested subscriptionId %q does not match verifier subscription %q", data.SubscriptionId, a.client.subscriptionID)
	}

	// Look up the VM or VMSS VM via the Azure API using the resource ID, cross-verify the attested
	// vmId, and extract node identity.
	var nodeName, igName string
	var addrs, challengeEndpoints []string

	switch resourceType {
	case vmResourceType:
		vmName := res.Name
		desc := fmt.Sprintf("VM %q", vmName)
		klog.V(2).Infof("Azure verifier for VM %q looking up Azure API object", vmLogID)

		vm, err := a.client.vmsClient.Get(ctx, a.client.resourceGroup, vmName, nil)
		if err != nil {
			return nil, fmt.Errorf("getting info for %s: %w", desc, err)
		}
		if vm.Properties == nil {
			return nil, fmt.Errorf("determining VMID for %s", desc)
		}
		nodeName, igName, err = extractNodeIdentity(data, desc, vm.Properties.VMID, vm.Properties.OSProfile, vm.Tags)
		if err != nil {
			return nil, err
		}

		// Collect private IP addresses from the VM's network interface.
		ni, err := a.client.nisClient.Get(ctx, a.client.resourceGroup, nodeName, nil)
		if err != nil {
			return nil, fmt.Errorf("getting info for %s network interface %q: %w", desc, nodeName, err)
		}
		addrs, challengeEndpoints, err = privateIPEndpoints(ni.Interface, desc)
		if err != nil {
			return nil, err
		}

View on GitHub (pinned to 4c8573c808)

Solutions

1. Check whether the VM still exists in the Azure portal or via az vm show
2. Verify kops-controller's credentials and RBAC scope for the resource group
3. Retry the request; transient ARM API errors are common

When it happens

Trigger: Thrown at upup/pkg/fi/cloudup/azure/verifier.go:167 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/752baed95d504420. Report an issue: GitHub.