kubernetes/kops · error

resource ID subscription %q does not match verifier subscrip

Error message

resource ID subscription %q does not match verifier subscription %q

What it means

The Azure resource ID embedded in the bootstrap token names a subscription different from the one kops-controller is configured with. Because the subsequent Azure API lookup is already scoped to the verifier's subscription, such a claim cannot describe a cluster VM, so it is rejected before any crypto or API work. Typically indicates a misconfigured token, a node from another cluster/subscription, or a tampered claim.

Source

Thrown at upup/pkg/fi/cloudup/azure/verifier.go:129

	if !ok || resourceID == "" || signature == "" {
		return nil, fmt.Errorf("incorrect token format")
	}

	// Parse the resource ID early to reject malformed tokens before expensive crypto.
	res, err := arm.ParseResourceID(resourceID)
	if err != nil {
		return nil, fmt.Errorf("parsing resource ID: %w", err)
	}
	vmLogID := vmLogIDFromResource(res)
	resourceType := res.ResourceType.String()
	klog.V(4).Infof("Azure verifier for VM %q parsed resource ID: subscription=%q resourceGroup=%q", vmLogID, res.SubscriptionID, res.ResourceGroupName)

	// Reject resource IDs outside the verifier's own subscription / resource group. The Azure API lookup below
	// is already scoped to kops-controller's subscription and resource group, so any claim that names a different
	// location cannot describe a cluster VM. Failing here avoids a wasted Azure API call and makes the scope
	// explicit instead of implicit.
	if !strings.EqualFold(res.SubscriptionID, a.client.subscriptionID) {
		return nil, fmt.Errorf("resource ID subscription %q does not match verifier subscription %q", res.SubscriptionID, a.client.subscriptionID)
	}
	if !strings.EqualFold(res.ResourceGroupName, a.client.resourceGroup) {
		return nil, fmt.Errorf("resource ID resource group %q does not match verifier resource group %q", res.ResourceGroupName, a.client.resourceGroup)
	}
	switch resourceType {
	case vmResourceType:
	case vmssVMResourceType:
		if !strings.HasSuffix(res.Parent.Name, "."+a.clusterName) {
			return nil, fmt.Errorf("resource ID VMSS name %q does not match cluster name %q", res.Parent.Name, a.clusterName)
		}
	default:
		return nil, fmt.Errorf("unsupported resource type %q", resourceType)
	}

	// Verify the PKCS7 attested document: signature, certificate chain, nonce, and expiration.
	data, err := a.attestation.verifyAttestedDocument(signature, body)
	if err != nil {
		return nil, err

View on GitHub (pinned to 4c8573c808)

Solutions

1. Check that the node's bootstrap token was issued for the subscription kops-controller manages
2. Verify the cluster's cloud configuration subscription matches the subscription the VM runs in
3. Discard the token; it is a cross-subscription claim and verification must fail

When it happens

Trigger: Thrown at upup/pkg/fi/cloudup/azure/verifier.go:129 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/2550c55aceef17d7. Report an issue: GitHub.