{"record":{"id":"26bca3edc1e3cd25","repo":"kubernetes/kops","slug":"loading-aws-config-w","errorCode":null,"errorMessage":"loading AWS config: %w","messagePattern":"loading AWS config: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"nodeup/pkg/model/networking/eni_networking.go","lineNumber":191,"sourceCode":"`, primary)\n\n\tc.AddTask(&nodetasks.File{\n\t\tPath:            \"/etc/systemd/network/75-eni-secondary.network\",\n\t\tContents:        fi.NewStringResource(contents),\n\t\tType:            nodetasks.FileType_File,\n\t\tAfterPackages:   true,\n\t\tOnChangeExecute: [][]string{{\"systemctl\", \"restart\", \"systemd-networkd\"}},\n\t})\n\treturn nil\n}\n\n// primaryInterfaceName gives the name of the primary network interface. It gets the MAC address\n// of the primary ENI (device-number 0) from the IMDS item \"mac\". Then it compares this MAC\n// address with the physical network interfaces in sysfs.\nfunc primaryInterfaceName(ctx context.Context) (string, error) {\n\tconfig, err := awsconfig.LoadDefaultConfig(ctx)\n\tif err != nil {\n\t\treturn \"\", fmt.Errorf(\"loading AWS config: %w\", err)\n\t}\n\tmetadata := imds.NewFromConfig(config)\n\tresp, err := metadata.GetMetadata(ctx, &imds.GetMetadataInput{Path: \"mac\"})\n\tif err != nil {\n\t\treturn \"\", fmt.Errorf(\"getting primary MAC address from ec2 metadata: %w\", err)\n\t}\n\tdefer resp.Content.Close()\n\tmac, err := io.ReadAll(resp.Content)\n\tif err != nil {\n\t\treturn \"\", fmt.Errorf(\"reading primary MAC address from ec2 metadata: %w\", err)\n\t}\n\n\treturn findPhysicalInterfaceByMAC(\"/sys/class/net\", strings.TrimSpace(string(mac)))\n}\n\n// findPhysicalInterfaceByMAC gives the name of the physical network interface that has the\n// specified MAC address. The function ignores the virtual interfaces (veths, bridges, VLANs),\n// because a virtual interface can have the same MAC address as a physical interface. The","sourceCodeStart":173,"sourceCodeEnd":209,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/nodeup/pkg/model/networking/eni_networking.go#L173-L209","documentation":"This error is wrapped at the single point where nodeup calls awsconfig.LoadDefaultConfig(ctx) to obtain an AWS SDK config for the EC2 IMDS client. It means the AWS SDK for Go v2 failed to build a default configuration (credential/provider chain or shared config loading), so nodeup cannot even reach the instance metadata service. Because markSecondaryENIsUnmanaged needs the primary ENI's MAC to write 75-eni-secondary.network, the whole secondary-ENI unmanaged marking is skipped when this fails.","triggerScenarios":"awsconfig.LoadDefaultConfig(ctx) returns an error, e.g. malformed AWS_CONFIG_FILE/AWS_SHARED_CREDENTIALS_FILE contents, an invalid AWS_REGION or AWS_PROFILE, or a failure resolving the shared config/credentials files on the node.","commonSituations":"Broken or hand-edited /etc/aws-config or ~/.aws/config on an AMI; a corrupted environment (AWS_PROFILE pointing at a nonexistent profile) baked into the node image; SDK shared-config parsing failures on AmazonLinux/Debian12 nodes where this builder runs.","solutions":["Inspect nodeup logs for the underlying wrapped error (%w) to see which config step failed","Fix or remove invalid AWS_* environment variables (AWS_PROFILE, AWS_REGION, AWS_CONFIG_FILE) on the node","Validate /root/.aws/config and /root/.aws/credentials (or the image-baked equivalents) parse as valid INI","Rebuild the node image so no stale/broken shared AWS config is present, then recycle the instance"],"exampleFix":"// before (env leaking into node provisioning)\nAWS_PROFILE=nonexistent kops-apply...\n// after\nunset AWS_PROFILE AWS_CONFIG_FILE; nodeup runs LoadDefaultConfig cleanly","handlingStrategy":"fallback","validationCode":"if os.Getenv(\"AWS_PROFILE\") != \"\" || os.Getenv(\"AWS_CONFIG_FILE\") != \"\" {\n    // log and clear before nodeup runs\n    os.Unsetenv(\"AWS_PROFILE\")\n    os.Unsetenv(\"AWS_CONFIG_FILE\")\n}","typeGuard":null,"tryCatchPattern":"primary, err := primaryInterfaceName(ctx)\nif err != nil {\n    return fmt.Errorf(\"finding primary network interface: %w\", err) // skip creating the unmanaged file; leave systemd-networkd defaults\n}","preventionTips":["Keep node images free of stale ~/.aws config files","Sanitize AWS_* env vars in nodeup's launch unit","Pin the AWS SDK config resolution path in tests","Log the wrapped cause before failing"],"tags":["aws","imds","config","nodeup"],"backgroundTag":"aws-config-load-failed","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T07:17:12.445Z"}