kubernetes/kops · error

node identity is required

Error message

node identity is required

What it means

In kops-controller's bootstrap server, getNodeConfig refuses to serve a node configuration when the identity argument is nil. bootstraptNodeAuthorization verifies the request's identity first; if that verification step failed silently or was skipped, the code defensively rejects the request rather than serving cluster secrets to an unauthenticated caller. This is a server-side guard, so it usually indicates an internal logic/state problem in the verification chain rather than bad user input.

Source

Thrown at cmd/kops-controller/pkg/server/node_config.go:38

	"context"
	"encoding/json"
	"fmt"

	"k8s.io/apimachinery/pkg/util/validation/field"
	"k8s.io/klog/v2"
	"k8s.io/kops/pkg/apis/kops"
	kopsvalidation "k8s.io/kops/pkg/apis/kops/validation"
	"k8s.io/kops/pkg/apis/nodeup"
	"k8s.io/kops/pkg/bootstrap"
	"k8s.io/kops/pkg/commands"
	"k8s.io/kops/pkg/nodeidentity/clusterapi"
)

func (s *Server) getNodeConfig(ctx context.Context, req *nodeup.BootstrapRequest, identity *bootstrap.VerifyResult) (*nodeup.NodeConfig, error) {
	log := klog.FromContext(ctx)

	if identity == nil {
		return nil, fmt.Errorf("node identity is required")
	}

	log.Info("getting node config", "req", req, "identity", identity)

	instanceGroupName := identity.InstanceGroupName
	if instanceGroupName == "" {
		if identity.CAPIMachine == nil {
			return nil, fmt.Errorf("did not find owner for node %q", identity.NodeName)
		}
		// CAPI path: the InstanceGroup is synthesized from the Machine and
		// the name never reaches the configBase path, so we don't validate it.
	} else if errs := kopsvalidation.ValidateInstanceGroupName(instanceGroupName, field.NewPath("instanceGroupName")); len(errs) > 0 {
		return nil, fmt.Errorf("invalid InstanceGroup name: %v", errs.ToAggregate())
	}

	var nodeConfig *nodeup.NodeConfig

	configBuilder := &commands.ConfigBuilder{

View on GitHub (pinned to 4c8573c808)

Solutions

1. Ensure bootstrap always runs the identity verification and returns a non-nil *bootstrap.VerifyResult before calling getNodeConfig
2. If you patched kops-controller, restore the code path that computes identity and returns early on verification failure instead of passing nil
3. Check the controller logs for the earlier verification failure that led to a nil identity
4. Upgrade to a released kops-controller version if running a modified binary

Example fix

// before (skips verification)
nodeConfig, err := s.getNodeConfig(ctx, req, nil)
// after
identity, err := s.verifyNode(ctx, req)
if err != nil {
	return nil, fmt.Errorf("verifying node: %w", err)
}
nodeConfig, err := s.getNodeConfig(ctx, req, identity)

if identity == nil {
	return fmt.Errorf("node identity is required")
}

func hasIdentity(v *bootstrap.VerifyResult) bool { return v != nil }

if err != nil {
	if strings.Contains(err.Error(), "node identity is required") {
		// re-run node bootstrap verification before retrying
		return reverifyAndBootstrap(node)
	}
	return err
}

When it happens

Trigger: A request reaches getNodeConfig with identity == nil — i.e. bootstrap passed nil for the *bootstrap.VerifyResult. This happens when the calling code path does not run (or ignores the result of) the identity verification step before calling getNodeConfig.

Common situations: Custom or patched builds of kops-controller where the verify step was made optional; a code change that calls getNodeConfig directly without a VerifyResult; misconfigured bootstrap authentication so verification is skipped and a nil result is propagated downstream.

Related errors

• did not find owner for node %q
• error building InstanceGroup from CAPI Machine: %w
• error loading NodeupConfig %q: %v
• invalid InstanceGroup name: %v
• CAPI Machine is missing cluster.x-k8s.io/deployment-name lab

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/780dc283ca112d19. Report an issue: GitHub.