{"record":{"id":"1c2b46950789adaa","repo":"kubernetes/kops","slug":"failed-to-get-q-from-ec2-meta-data-v","errorCode":null,"errorMessage":"failed to get %q from ec2 meta-data: %v","messagePattern":"failed to get %q from ec2 meta-data: (.+?)","errorType":"console","errorClass":null,"httpStatus":null,"severity":"error","filePath":"upup/pkg/fi/nodeup/nodetasks/prefix.go","lineNumber":134,"sourceCode":"\t\treturn \"\", fmt.Errorf(\"failed to get %q from ec2 meta-data: not found\", category)\n\t}\n\n\treturn values[0], nil\n}\n\nfunc getInstanceMetadataList(ctx context.Context, category string) ([]string, error) {\n\tcfg, err := awsconfig.LoadDefaultConfig(ctx)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"failed to load aws config: %v\", err)\n\t}\n\tmetadata := imds.NewFromConfig(cfg)\n\tresp, err := metadata.GetMetadata(ctx, &imds.GetMetadataInput{Path: category})\n\tif err != nil {\n\t\tvar awsErr *smithyhttp.ResponseError\n\t\tif errors.As(err, &awsErr) && awsErr.HTTPStatusCode() == http.StatusNotFound {\n\t\t\treturn nil, nil\n\t\t} else {\n\t\t\treturn nil, fmt.Errorf(\"failed to get %q from ec2 meta-data: %v\", category, err)\n\t\t}\n\t}\n\tdefer resp.Content.Close()\n\tlines, err := io.ReadAll(resp.Content)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"failed to read %q from ec2 meta-data: %v\", category, err)\n\t}\n\n\tvar values []string\n\tfor _, line := range strings.Split(string(lines), \"\\n\") {\n\t\tline = strings.TrimSpace(line)\n\t\tif len(line) > 0 {\n\t\t\tvalues = append(values, line)\n\t\t}\n\t}\n\n\treturn values, nil\n}","sourceCodeStart":116,"sourceCodeEnd":152,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/upup/pkg/fi/nodeup/nodetasks/prefix.go#L116-L152","documentation":"When the IMDS GetMetadata call fails with an error that is not a 404 ResponseError, the task wraps it with 'failed to get %q from ec2 meta-data'. This covers connectivity failures, timeouts, auth/hop-limit errors and 5xx responses from the metadata service.","triggerScenarios":"IMDS unreachable (169.254.169.254 blocked by firewall/NetworkPolicy), HTTP 401/403 from IMDS token requirements (IMDSv2 hop limit), or non-404 HTTP errors.","commonSituations":"Containers on the host network with hop limit 1; iptables rules blocking link-local traffic; IMDSv2 enforced with token fetch failing; EC2 maintenance returning 5xx.","solutions":["Confirm the metadata endpoint is reachable: curl http://169.254.169.254/latest/meta-data/.","Increase the IMDS hop limit to 2+ if nodeup runs inside a container.","Ensure IMDSv2 token requests succeed (no proxy interfering with PUT to the token endpoint).","Check security groups/host firewall allow egress to 169.254.169.254."],"exampleFix":null,"handlingStrategy":"retry","validationCode":"conn, err := net.DialTimeout(\"tcp\", \"169.254.169.254:80\", 2*time.Second)\nif err != nil { return errors.New(\"IMDS endpoint blocked\") }","typeGuard":null,"tryCatchPattern":"var respErr *smithyhttp.ResponseError\nif errors.As(err, &respErr) && respErr.HTTPStatusCode() >= 500 {\n    // transient: retry with backoff\n}","preventionTips":["Allow egress to 169.254.169.254 from the node","Raise hop limit for containerized nodeup","Ensure IMDSv2 token requests (PUT) are not proxied"],"tags":["aws","imds","networking","ec2"],"backgroundTag":"instance-metadata-unavailable","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T12:17:11.808Z"}