kubernetes/kops · error

unable to decode addresses: %w

Error message

unable to decode addresses: %w

What it means

The server's 'addresses' field from Nova could not be decoded into the expected map[string][]Address structure via mapstructure. The instance address payload had an unexpected shape, so no addresses could be extracted for verification.

Source

Thrown at upup/pkg/fi/cloudup/openstack/verifier.go:140

}

func (o openstackVerifier) VerifyToken(ctx context.Context, rawRequest *http.Request, token string, body []byte) (*bootstrap.VerifyResult, error) {
	if !strings.HasPrefix(token, openstackmetadata.OpenstackAuthenticationTokenPrefix) {
		return nil, bootstrap.ErrNotThisVerifier
	}
	serverID := strings.TrimPrefix(token, openstackmetadata.OpenstackAuthenticationTokenPrefix)

	instance, err := servers.Get(ctx, o.novaClient, serverID).Extract()
	if err != nil {
		return nil, fmt.Errorf("failed to get info for server %q: %w", token, err)
	}

	var addrs []string

	var addresses map[string][]Address
	err = mapstructure.Decode(instance.Addresses, &addresses)
	if err != nil {
		return nil, fmt.Errorf("unable to decode addresses: %w", err)
	}

	for _, addrList := range addresses {
		for _, props := range addrList {
			addrs = append(addrs, props.Addr)
		}
	}
	// ensure that request is coming from same machine
	requestAddr, _, err := net.SplitHostPort(rawRequest.RemoteAddr)
	if err != nil {
		return nil, fmt.Errorf("invalid remote address %q: %v", rawRequest.RemoteAddr, err)
	}
	if !stringInSlice(requestAddr, addrs) {
		return nil, fmt.Errorf("authentication request address %q does not match server addresses %v", requestAddr, addrs)
	}

	// We will call back onto this address, now that we have verified it is an instance IP
	challengeEndpoint := net.JoinHostPort(requestAddr, strconv.Itoa(wellknownports.NodeupChallenge))

View on GitHub (pinned to 4c8573c808)

Solutions

1. Inspect the server's addresses field via openstack server show
2. Check for OpenStack distributions returning non-standard address formats
3. Report the payload shape if it differs from the expected structure

When it happens

Trigger: Thrown at upup/pkg/fi/cloudup/openstack/verifier.go:140 when the library encounters an invalid state.

Common situations: See trigger scenarios.

Understand the failure class

• Parsing and encoding errors: unexpected token, malformed input — why parsers reject input and how to find the real culprit.

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/8a1fcee821f3110d. Report an issue: GitHub.