kubernetes/kops · error

invalid remote address %q: %v

Error message

invalid remote address %q: %v

What it means

The HTTP RemoteAddr of the bootstrap request could not be split into host and port by net.SplitHostPort, so the source IP of the requester cannot be determined for the same-machine check. Typically a malformed or proxy-mangled peer address.

Source

Thrown at upup/pkg/fi/cloudup/openstack/verifier.go:151

	}

	var addrs []string

	var addresses map[string][]Address
	err = mapstructure.Decode(instance.Addresses, &addresses)
	if err != nil {
		return nil, fmt.Errorf("unable to decode addresses: %w", err)
	}

	for _, addrList := range addresses {
		for _, props := range addrList {
			addrs = append(addrs, props.Addr)
		}
	}
	// ensure that request is coming from same machine
	requestAddr, _, err := net.SplitHostPort(rawRequest.RemoteAddr)
	if err != nil {
		return nil, fmt.Errorf("invalid remote address %q: %v", rawRequest.RemoteAddr, err)
	}
	if !stringInSlice(requestAddr, addrs) {
		return nil, fmt.Errorf("authentication request address %q does not match server addresses %v", requestAddr, addrs)
	}

	// We will call back onto this address, now that we have verified it is an instance IP
	challengeEndpoint := net.JoinHostPort(requestAddr, strconv.Itoa(wellknownports.NodeupChallenge))

	// check from kubernetes API does the instance already exist
	_, err = o.kubeClient.CoreV1().Nodes().Get(ctx, instance.Name, v1.GetOptions{})
	if err == nil {
		return nil, bootstrap.ErrAlreadyExists
	}
	if err != nil && !errors.IsNotFound(err) {
		return nil, fmt.Errorf("got error while querying kubernetes api: %w", err)
	}

	result := &bootstrap.VerifyResult{

View on GitHub (pinned to 4c8573c808)

Solutions

1. Inspect the reverse-proxy/load-balancer in front of kops-controller; it must preserve a valid RemoteAddr
2. Ensure requests reach the verifier directly or via a proxy that sets a proper address
3. Reject the request: the peer address is unparseable

When it happens

Trigger: Thrown at upup/pkg/fi/cloudup/openstack/verifier.go:151 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/055defe61858abf7. Report an issue: GitHub.