{"record":{"id":"6f5ead8cf219c9de","repo":"kubernetes/kops","slug":"querying-instance-metadata-w","errorCode":null,"errorMessage":"querying instance metadata: %w","messagePattern":"querying instance metadata: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"critical","filePath":"upup/pkg/fi/cloudup/azure/azuremetadata/authenticator.go","lineNumber":53,"sourceCode":"// NewAzureAuthenticator returns an authenticator that mints Azure bootstrap tokens backed by IMDS\n// metadata and an attested document signature.\nfunc NewAzureAuthenticator() (bootstrap.Authenticator, error) {\n\treturn &azureAuthenticator{}, nil\n}\n\n// CreateToken fetches the local VM identity from IMDS and returns a bootstrap token containing the\n// resource ID and signed attested document.\nfunc (h *azureAuthenticator) CreateToken(body []byte) (string, error) {\n\tklog.V(4).Infof(\"Azure authenticator creating bootstrap token\")\n\n\t// bootstrap.Authenticator.CreateToken carries no context; the IMDS HTTP client's own timeout\n\t// bounds these calls.\n\tctx := context.TODO()\n\n\t// Query IMDS for the VM's resource ID.\n\tmetadata, err := QueryComputeInstanceMetadata(ctx)\n\tif err != nil {\n\t\treturn \"\", fmt.Errorf(\"querying instance metadata: %w\", err)\n\t}\n\tif metadata.ResourceID == \"\" {\n\t\treturn \"\", fmt.Errorf(\"missing resource ID\")\n\t}\n\tklog.V(4).Infof(\"Azure authenticator obtained resource ID %q\", metadata.ResourceID)\n\n\t// Query IMDS for a PKCS7-signed attested document containing the nonce.\n\tnonce := NonceForBody(body)\n\tdoc, err := queryIMDSAttestedDocument(ctx, nonce)\n\tif err != nil {\n\t\treturn \"\", fmt.Errorf(\"querying attested document: %w\", err)\n\t}\n\tif doc.Signature == \"\" {\n\t\treturn \"\", fmt.Errorf(\"empty attested document signature\")\n\t}\n\tklog.V(2).Infof(\"Azure authenticator obtained attested document for %q\", metadata.ResourceID)\n\n\t// Token format: \"x-azure-id <resourceID> <base64-pkcs7-signature>\"","sourceCodeStart":35,"sourceCodeEnd":71,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/upup/pkg/fi/cloudup/azure/azuremetadata/authenticator.go#L35-L71","documentation":"CreateToken wraps any failure from QueryComputeInstanceMetadata with the \"querying instance metadata\" prefix. It means the node could not fetch its compute metadata from the Azure IMDS endpoint (http://169.254.169.254/metadata/instance/compute), so a bootstrap token backed by the VM identity cannot be minted. The library throws this because bootstrap authentication requires the VM's Azure resource ID as the node identity.","triggerScenarios":"azureAuthenticator.CreateToken is invoked during node bootstrap (nodeup) and the inner queryIMDS call to /metadata/instance/compute fails: request creation error, HTTP client error (timeout, connection refused), non-200 status, body read error, or JSON unmarshal error.","commonSituations":"Running on a non-Azure VM or a local/dev environment where 169.254.169.254 is unroutable; NSG or firewall rules blocking the link-local IMDS address; IMDS throttling (429); a proxy env var interfering (though the client bypasses proxies); IMDS API version retired; transient IMDS unavailability right after VM boot.","solutions":["Verify the node is an Azure VM and IMDS is reachable: curl -H Metadata:true 'http://169.254.169.254/metadata/instance/compute?api-version=2025-04-07&format=json'","Check the underlying wrapped error in the message (%w chain) to distinguish network failure vs bad status and fix accordingly","If it occurs at boot, add retry/backoff — IMDS can be briefly unavailable after VM start","Ensure no NSG/firewall rules block 169.254.169.254 and no broken proxy is configured for the node process","Confirm the IMDS api-version used by this kOps build is still supported by Azure"],"exampleFix":null,"handlingStrategy":"retry","validationCode":"// Check IMDS reachability before invoking bootstrap\nfunc imdsReachable() error {\n    c := &http.Client{Timeout: 5 * time.Second, Transport: &http.Transport{Proxy: nil}}\n    req, _ := http.NewRequest(\"GET\", \"http://169.254.169.254/metadata/instance/compute?api-version=2025-04-07&format=json\", nil)\n    req.Header.Set(\"Metadata\", \"true\")\n    resp, err := c.Do(req)\n    if err != nil { return err }\n    defer resp.Body.Close()\n    if resp.StatusCode != 200 { return fmt.Errorf(\"imds status %d\", resp.StatusCode) }\n    return nil\n}","typeGuard":null,"tryCatchPattern":"// Retry transient IMDS failures with backoff\nvar token string\nerr := wait.PollImmediate(2*time.Second, 2*time.Minute, func() (bool, error) {\n    t, err := authenticator.CreateToken(body)\n    if err != nil {\n        klog.V(2).Infof(\"retrying CreateToken: %v\", err)\n        return false, nil\n    }\n    token = t\n    return true, nil\n})","preventionTips":["Probe IMDS with curl before enabling IMDS-based bootstrap authentication","Add retry/backoff around CreateToken, especially at VM boot","Never route 169.254.169.254 through proxies; keep Proxy disabled","Pin and periodically review the IMDS api-version supported by your kOps build"],"tags":["azure","imds","network","bootstrap"],"backgroundTag":"imds-unreachable","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T07:17:12.445Z"}