kubernetes/kops · error

resource ID VMSS name %q does not match cluster name %q

Error message

resource ID VMSS name %q does not match cluster name %q

What it means

For a VMSS-backed instance, the parent VMSS name in the resource ID does not end with '.' + cluster name, meaning the token claims membership in a scale set that does not belong to this cluster. The verifier only accepts VMSS VMs whose scale set is named after the cluster, so the claim is rejected before the Azure API is consulted.

Source

Thrown at upup/pkg/fi/cloudup/azure/verifier.go:138

	vmLogID := vmLogIDFromResource(res)
	resourceType := res.ResourceType.String()
	klog.V(4).Infof("Azure verifier for VM %q parsed resource ID: subscription=%q resourceGroup=%q", vmLogID, res.SubscriptionID, res.ResourceGroupName)

	// Reject resource IDs outside the verifier's own subscription / resource group. The Azure API lookup below
	// is already scoped to kops-controller's subscription and resource group, so any claim that names a different
	// location cannot describe a cluster VM. Failing here avoids a wasted Azure API call and makes the scope
	// explicit instead of implicit.
	if !strings.EqualFold(res.SubscriptionID, a.client.subscriptionID) {
		return nil, fmt.Errorf("resource ID subscription %q does not match verifier subscription %q", res.SubscriptionID, a.client.subscriptionID)
	}
	if !strings.EqualFold(res.ResourceGroupName, a.client.resourceGroup) {
		return nil, fmt.Errorf("resource ID resource group %q does not match verifier resource group %q", res.ResourceGroupName, a.client.resourceGroup)
	}
	switch resourceType {
	case vmResourceType:
	case vmssVMResourceType:
		if !strings.HasSuffix(res.Parent.Name, "."+a.clusterName) {
			return nil, fmt.Errorf("resource ID VMSS name %q does not match cluster name %q", res.Parent.Name, a.clusterName)
		}
	default:
		return nil, fmt.Errorf("unsupported resource type %q", resourceType)
	}

	// Verify the PKCS7 attested document: signature, certificate chain, nonce, and expiration.
	data, err := a.attestation.verifyAttestedDocument(signature, body)
	if err != nil {
		return nil, err
	}
	klog.V(2).Infof("Azure verifier for VM %q verified attested document", vmLogID)
	if !strings.EqualFold(data.SubscriptionId, a.client.subscriptionID) {
		return nil, fmt.Errorf("attested subscriptionId %q does not match verifier subscription %q", data.SubscriptionId, a.client.subscriptionID)
	}

	// Look up the VM or VMSS VM via the Azure API using the resource ID, cross-verify the attested
	// vmId, and extract node identity.
	var nodeName, igName string

View on GitHub (pinned to 4c8573c808)

Solutions

1. Verify the VMSS the node belongs to was created by this kops cluster
2. Check the cluster name in the token/resource ID for typos or drift
3. Reject the token: the node does not belong to this cluster's scale sets

When it happens

Trigger: Thrown at upup/pkg/fi/cloudup/azure/verifier.go:138 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/20b42694972dac06. Report an issue: GitHub.