kubernetes/kops · error

parsing resource ID: %w

Error message

parsing resource ID: %w

What it means

The <resourceID> part of the Azure attestation token could not be parsed into an Azure resource ID (subscription/resource group/type/name structure), so the claimed VM cannot be resolved through the Azure API.

Source

Thrown at upup/pkg/fi/cloudup/azure/verifier.go:118

// VerifyToken validates the Azure attestation token, confirms the claimed VM through the Azure API,
// and returns the node bootstrap identity.
func (a azureVerifier) VerifyToken(ctx context.Context, rawRequest *http.Request, token string, body []byte) (*bootstrap.VerifyResult, error) {
	if !strings.HasPrefix(token, azuremetadata.AzureAuthenticationTokenPrefix) {
		return nil, bootstrap.ErrNotThisVerifier
	}

	// Token format: "x-azure-id <resourceID> <base64-pkcs7-signature>"
	tokenPayload := strings.TrimPrefix(token, azuremetadata.AzureAuthenticationTokenPrefix)
	resourceID, signature, ok := strings.Cut(tokenPayload, " ")
	if !ok || resourceID == "" || signature == "" {
		return nil, fmt.Errorf("incorrect token format")
	}

	// Parse the resource ID early to reject malformed tokens before expensive crypto.
	res, err := arm.ParseResourceID(resourceID)
	if err != nil {
		return nil, fmt.Errorf("parsing resource ID: %w", err)
	}
	vmLogID := vmLogIDFromResource(res)
	resourceType := res.ResourceType.String()
	klog.V(4).Infof("Azure verifier for VM %q parsed resource ID: subscription=%q resourceGroup=%q", vmLogID, res.SubscriptionID, res.ResourceGroupName)

	// Reject resource IDs outside the verifier's own subscription / resource group. The Azure API lookup below
	// is already scoped to kops-controller's subscription and resource group, so any claim that names a different
	// location cannot describe a cluster VM. Failing here avoids a wasted Azure API call and makes the scope
	// explicit instead of implicit.
	if !strings.EqualFold(res.SubscriptionID, a.client.subscriptionID) {
		return nil, fmt.Errorf("resource ID subscription %q does not match verifier subscription %q", res.SubscriptionID, a.client.subscriptionID)
	}
	if !strings.EqualFold(res.ResourceGroupName, a.client.resourceGroup) {
		return nil, fmt.Errorf("resource ID resource group %q does not match verifier resource group %q", res.ResourceGroupName, a.client.resourceGroup)
	}
	switch resourceType {
	case vmResourceType:
	case vmssVMResourceType:

View on GitHub (pinned to 4c8573c808)

Solutions

1. Reject the bootstrap token; the resource ID is malformed or forged
2. Regenerate the token on the node
3. Verify the node is constructing the token from genuine IMDS-provided metadata

When it happens

Trigger: Thrown at upup/pkg/fi/cloudup/azure/verifier.go:118 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/877c7bd07363b687. Report an issue: GitHub.