{"record":{"id":"6a92116ffa8394e6","repo":"kubernetes/kops","slug":"failed-to-get-droplet-region-s","errorCode":null,"errorMessage":"failed to get droplet region: %s","messagePattern":"failed to get droplet region: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/nodeidentity/do/identify.go","lineNumber":67,"sourceCode":"\tcache        expirationcache.Store\n\tcacheEnabled bool\n}\n\n// TokenSource implements oauth2.TokenSource.\ntype TokenSource struct {\n\tAccessToken string\n}\n\n// Token returns an oauth2.Token for the configured access token.\nfunc (t *TokenSource) Token() (*oauth2.Token, error) {\n\treturn &oauth2.Token{AccessToken: t.AccessToken}, nil\n}\n\n// New creates and returns a nodeidentity.Identifier for nodes running on DigitalOcean.\nfunc New(cacheNodeidentityInfo bool) (nodeidentity.Identifier, error) {\n\tregion, err := getMetadataRegion()\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"failed to get droplet region: %s\", err)\n\t}\n\n\tdoClient, err := NewCloud(region)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"failed to initialize digitalocean cloud: %s\", err)\n\t}\n\n\treturn &nodeIdentifier{\n\t\tdoClient:     doClient,\n\t\tcache:        expirationcache.NewTTLStore(stringKeyFunc, cacheTTL),\n\t\tcacheEnabled: cacheNodeidentityInfo,\n\t}, nil\n}\n\nfunc getMetadataRegion() (string, error) {\n\treturn getMetadata(dropletRegionMetadataURL)\n}\n","sourceCodeStart":49,"sourceCodeEnd":85,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/pkg/nodeidentity/do/identify.go#L49-L85","documentation":"New() builds the DigitalOcean nodeidentifier and first needs the Droplet's region, read from the DigitalOcean metadata service (169.254.169.254). If getMetadataRegion fails (metadata service unreachable, error response, or unparseable body), New aborts with \"failed to get droplet region\". Without the region the DO API client cannot be scoped correctly.","triggerScenarios":"Running kOps' DO nodeidentifier code on a machine that is not a DigitalOcean Droplet (laptop, CI runner, non-DO cloud); DO metadata service blocked by firewall/network policy; metadata endpoint returning non-200 or malformed region; IPv6-only networking where the link-local metadata address is unreachable.","commonSituations":"Local development/testing of kops against a DO cluster from off-cluster; network firewall (cloud firewall, nftables) blocking 169.254.169.254; DO metadata service incidents; running inside a container without host network access to the link-local address.","solutions":["Run the component on a DigitalOcean Droplet, or test connectivity: curl http://169.254.169.254/metadata/v1/region.","Check firewall/network policy allows access to the link-local metadata address 169.254.169.254.","When running in containers, use host networking (--net=host) so the link-local address is reachable.","Verify the DO metadata service status (status.digitalocean.com) for incidents and retry."],"exampleFix":"// before: running identifier locally on a laptop\nid, err := nodeidentity.New(true) // fails: no metadata service\n\n// after: run inside a Droplet or inject region for tests\nif os.Getenv(\"KOPS_DO_REGION\") != \"\" {\n    region = os.Getenv(\"KOPS_DO_REGION\")\n} else {\n    region, err = getMetadataRegion()\n}","handlingStrategy":"validation","validationCode":"resp, err := http.Get(\"http://169.254.169.254/metadata/v1/region\")\nif err != nil || resp.StatusCode != http.StatusOK {\n    return fmt.Errorf(\"not running on a DO Droplet or metadata blocked: err=%v\", err)\n}\nresp.Body.Close()","typeGuard":null,"tryCatchPattern":"id, err := nodeidentity.New(true)\nif err != nil && strings.Contains(err.Error(), \"failed to get droplet region\") {\n    return fmt.Errorf(\"run this component on a Droplet with access to 169.254.169.254: %w\", err)\n}","preventionTips":["Run DO-dependent components only on Droplets","Whitelist 169.254.169.254 in host and container firewalls","Use host networking in containers needing Droplet metadata","Smoke-test metadata reachability in startup health checks"],"tags":["digitalocean","metadata-service","network","kops"],"backgroundTag":"metadata-service-unreachable","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T07:17:12.445Z"}