kubernetes/kops · error

host not found for %v

Error message

host not found for %v

What it means

getSigningKey looks up a kops.Host resource in the kops-system namespace whose name equals the node name from the bootstrap token. When the controller-runtime client Get returns an IsNotFound error, the verifier rejects the token with "host not found for <NamespacedName>". This means no Host object has been registered (or no longer exists) for the machine attempting PKI bootstrap.

Source

Thrown at pkg/bootstrap/pkibootstrap/pkiverifier/verifier.go:141

	}

	if !verifySignature(signingKey, token.Data, token.Signature) {
		return nil, fmt.Errorf("failed to verify claim signature for node")
	}

	return result, nil
}

func (v *verifier) getSigningKey(ctx context.Context, tokenData *pkibootstrap.AuthTokenData) (*bootstrap.VerifyResult, crypto.PublicKey, error) {
	nodeName := tokenData.Instance
	id := types.NamespacedName{
		Namespace: "kops-system",
		Name:      nodeName,
	}
	var host kops.Host
	if err := v.client.Get(ctx, id, &host); err != nil {
		if apierrors.IsNotFound(err) {
			return nil, nil, fmt.Errorf("host not found for %v", id)
		}
		return nil, nil, fmt.Errorf("error getting host %v: %w", id, err)
	}

	// TODO: Check instance-group matches request (does it matter?)

	if host.Spec.PublicKey == "" {
		return nil, nil, fmt.Errorf("host %v did not have public-key", id)
	}
	instanceGroup := host.Spec.InstanceGroup
	if instanceGroup == "" {
		return nil, nil, fmt.Errorf("host %v did not have spec.instanceGroup", id)
	}
	pubKey, err := pki.ParsePEMPublicKey([]byte(host.Spec.PublicKey))
	if err != nil {
		return nil, nil, fmt.Errorf("failed to parse public key: %w", err)
	}

View on GitHub (pinned to 4c8573c808)

Solutions

1. Create (or recreate) the kops.Host resource in the kops-system namespace with metadata.name matching the node name from the token
2. Verify the node's reported instance name (tokenData.Instance) matches the Host object name exactly; fix node metadata or Host metadata if they diverge
3. Confirm the Host CRD is installed and that whatever reconciles Host objects (the cloud provider integration) is running
4. Check kops-controller logs for the full NamespacedName to see which name/namespace was requested

Example fix

// before: node bootstraps but no Host exists
// kubectl get host -n kops-system node1 -> NotFound

// after: register the host
// kubectl apply -f - <<EOF
// apiVersion: kops.k8s.io/v1alpha2
// kind: Host
// metadata:
//   name: node1
//   namespace: kops-system
// spec:
//   publicKey: <PEM public key>
//   instanceGroup: nodes
// EOF

var host kops.Host
if err := c.Get(ctx, types.NamespacedName{Namespace: "kops-system", Name: nodeName}, &host); err != nil {
    if apierrors.IsNotFound(err) {
        return fmt.Errorf("Host %s/%s does not exist; create it before bootstrapping", "kops-system", nodeName)
    }
    return err
}

func hostExists(ctx context.Context, c client.Client, nodeName string) bool {
    var h kops.Host
    return c.Get(ctx, types.NamespacedName{Namespace: "kops-system", Name: nodeName}, &h) == nil
}

result, err := verifier.VerifyToken(ctx, req, token, body)
if err != nil {
    if strings.Contains(err.Error(), "host not found for") {
        // register/recreate the Host object then retry bootstrap
        return bootstrapHost(nodeName)
    }
    return err
}

When it happens

Trigger: A node calls kops-controller's bootstrap VerifyToken with a valid signed token, but the Host object named tokenData.Instance (namespace kops-system) does not exist in the cluster, e.g. the Host CR was never created, was deleted, or the token's Instance field names a node with no matching Host.

Common situations: Cluster upgraded to the machine-key/PKI bootstrap flow without creating Host resources; Host CR deleted by automation or by mistake; node renamed or replaced but Host record not updated; node name casing mismatch between cloud provider metadata and the Host object name; RBAC/namespace issues are NOT the cause here (those hit the second error).

Understand the failure class

Background: 'Could not be found', 'does not exist', 'not found in database': the resource-not-found family when an ID, slug, key, or URI lookup comes back empty — this error's family across 20 libraries.

Related errors

• node identity is required
• did not find owner for node %q
• error building InstanceGroup from CAPI Machine: %w
• error loading NodeupConfig %q: %v
• CAPI Machine is missing cluster.x-k8s.io/deployment-name lab

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/b2eebed84134b3e5. Report an issue: GitHub.