kubernetes/kops · error

unsupported resource type %q

Error message

unsupported resource type %q

What it means

The resource ID in the token names a resource type other than the two supported kinds (a standalone virtualMachine or a virtualMachineScaleSet VM). The verifier can only attest these types; any other ARM resource type is rejected by the switch default before attestation checking.

Source

Thrown at upup/pkg/fi/cloudup/azure/verifier.go:141

	// Reject resource IDs outside the verifier's own subscription / resource group. The Azure API lookup below
	// is already scoped to kops-controller's subscription and resource group, so any claim that names a different
	// location cannot describe a cluster VM. Failing here avoids a wasted Azure API call and makes the scope
	// explicit instead of implicit.
	if !strings.EqualFold(res.SubscriptionID, a.client.subscriptionID) {
		return nil, fmt.Errorf("resource ID subscription %q does not match verifier subscription %q", res.SubscriptionID, a.client.subscriptionID)
	}
	if !strings.EqualFold(res.ResourceGroupName, a.client.resourceGroup) {
		return nil, fmt.Errorf("resource ID resource group %q does not match verifier resource group %q", res.ResourceGroupName, a.client.resourceGroup)
	}
	switch resourceType {
	case vmResourceType:
	case vmssVMResourceType:
		if !strings.HasSuffix(res.Parent.Name, "."+a.clusterName) {
			return nil, fmt.Errorf("resource ID VMSS name %q does not match cluster name %q", res.Parent.Name, a.clusterName)
		}
	default:
		return nil, fmt.Errorf("unsupported resource type %q", resourceType)
	}

	// Verify the PKCS7 attested document: signature, certificate chain, nonce, and expiration.
	data, err := a.attestation.verifyAttestedDocument(signature, body)
	if err != nil {
		return nil, err
	}
	klog.V(2).Infof("Azure verifier for VM %q verified attested document", vmLogID)
	if !strings.EqualFold(data.SubscriptionId, a.client.subscriptionID) {
		return nil, fmt.Errorf("attested subscriptionId %q does not match verifier subscription %q", data.SubscriptionId, a.client.subscriptionID)
	}

	// Look up the VM or VMSS VM via the Azure API using the resource ID, cross-verify the attested
	// vmId, and extract node identity.
	var nodeName, igName string
	var addrs, challengeEndpoints []string

	switch resourceType {

View on GitHub (pinned to 4c8573c808)

Solutions

1. Ensure the token was minted by a node running on an Azure VM or VMSS VM instance
2. Check for a malformed or hand-crafted resource ID in the token
3. Extend the verifier's resource-type switch only if a new node type is officially supported

When it happens

Trigger: Thrown at upup/pkg/fi/cloudup/azure/verifier.go:141 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/429688d0c8fc830e. Report an issue: GitHub.