kubernetes/kops · error

resource ID resource group %q does not match verifier resour

Error message

resource ID resource group %q does not match verifier resource group %q

What it means

The resource group in the token's resource ID differs from the verifier's configured resource group. The Azure API calls later in verification are scoped to kops-controller's resource group, so a claim pointing elsewhere cannot refer to a cluster VM and is rejected early to avoid a wasted API call. Usually a misrouted token from a node in a different cluster or resource group.

Source

Thrown at upup/pkg/fi/cloudup/azure/verifier.go:132

	// Parse the resource ID early to reject malformed tokens before expensive crypto.
	res, err := arm.ParseResourceID(resourceID)
	if err != nil {
		return nil, fmt.Errorf("parsing resource ID: %w", err)
	}
	vmLogID := vmLogIDFromResource(res)
	resourceType := res.ResourceType.String()
	klog.V(4).Infof("Azure verifier for VM %q parsed resource ID: subscription=%q resourceGroup=%q", vmLogID, res.SubscriptionID, res.ResourceGroupName)

	// Reject resource IDs outside the verifier's own subscription / resource group. The Azure API lookup below
	// is already scoped to kops-controller's subscription and resource group, so any claim that names a different
	// location cannot describe a cluster VM. Failing here avoids a wasted Azure API call and makes the scope
	// explicit instead of implicit.
	if !strings.EqualFold(res.SubscriptionID, a.client.subscriptionID) {
		return nil, fmt.Errorf("resource ID subscription %q does not match verifier subscription %q", res.SubscriptionID, a.client.subscriptionID)
	}
	if !strings.EqualFold(res.ResourceGroupName, a.client.resourceGroup) {
		return nil, fmt.Errorf("resource ID resource group %q does not match verifier resource group %q", res.ResourceGroupName, a.client.resourceGroup)
	}
	switch resourceType {
	case vmResourceType:
	case vmssVMResourceType:
		if !strings.HasSuffix(res.Parent.Name, "."+a.clusterName) {
			return nil, fmt.Errorf("resource ID VMSS name %q does not match cluster name %q", res.Parent.Name, a.clusterName)
		}
	default:
		return nil, fmt.Errorf("unsupported resource type %q", resourceType)
	}

	// Verify the PKCS7 attested document: signature, certificate chain, nonce, and expiration.
	data, err := a.attestation.verifyAttestedDocument(signature, body)
	if err != nil {
		return nil, err
	}
	klog.V(2).Infof("Azure verifier for VM %q verified attested document", vmLogID)
	if !strings.EqualFold(data.SubscriptionId, a.client.subscriptionID) {

View on GitHub (pinned to 4c8573c808)

Solutions

1. Confirm the VM issuing the token lives in the resource group configured for the cluster
2. Check for stale tokens or nodes reused from another kops cluster
3. Re-issue bootstrap credentials for the node

When it happens

Trigger: Thrown at upup/pkg/fi/cloudup/azure/verifier.go:132 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/841097db1e7465b3. Report an issue: GitHub.