{"record":{"id":"7496fe73a7f7e249","repo":"kubernetes/kops","slug":"error-reading-instance-id-from-aws-metadata-v","errorCode":null,"errorMessage":"error reading instance-id from AWS metadata: %v","messagePattern":"error reading instance-id from AWS metadata: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"critical","filePath":"upup/pkg/fi/nodeup/command.go","lineNumber":252,"sourceCode":"\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"error building key store path: %v\", err)\n\t\t}\n\n\t\tmodelContext.KeyStore = fi.NewVFSKeystoreReader(p)\n\t\tkeyStore = modelContext.KeyStore\n\t} else {\n\t\treturn fmt.Errorf(\"KeyStore not set\")\n\t}\n\n\tif err := modelContext.Init(); err != nil {\n\t\treturn err\n\t}\n\n\tswitch bootConfig.CloudProvider {\n\tcase api.CloudProviderAWS:\n\t\tinstanceIDBytes, err := vfs.Context.ReadFile(\"metadata://aws/meta-data/instance-id\")\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"error reading instance-id from AWS metadata: %v\", err)\n\t\t}\n\t\tmodelContext.InstanceID = string(instanceIDBytes)\n\n\t\t// Check if WarmPool is enabled first, to avoid additional API calls\n\t\tif len(modelContext.NodeupConfig.WarmPoolImages) > 0 {\n\t\t\tmodelContext.ConfigurationMode, err = getAWSConfigurationMode(ctx, modelContext)\n\t\t\tif err != nil {\n\t\t\t\treturn err\n\t\t\t}\n\t\t}\n\n\t\tmodelContext.MachineType, err = getMachineType(ctx)\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"failed to get machine type: %w\", err)\n\t\t}\n\n\t\t// If Nvidia is enabled in the cluster, check if this instance has support for it.\n\t\tnvidia := modelContext.NodeupConfig.ContainerdConfig.NvidiaGPU","sourceCodeStart":234,"sourceCodeEnd":270,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/upup/pkg/fi/nodeup/command.go#L234-L270","documentation":"nodeup's Run() reads the EC2 instance-id via the vfs layer at metadata://aws/meta-data/instance-id when bootConfig.CloudProvider is AWS. This error wraps any failure of that read — typically the EC2 Instance Metadata Service (IMDS) was unreachable, returned an error, or the metadata vfs backed by nodeup's local metadata context failed. Without the instance-id, nodeup cannot identify the node for warm-pool/lifecycle handling, so it aborts bootstrap.","triggerScenarios":"bootConfig.CloudProvider == api.CloudProviderAWS and vfs.Context.ReadFile(\"metadata://aws/meta-data/instance-id\") returns an error (IMDS unreachable, IMDSv2 hop limit exceeded, metadata disabled on the instance, or missing metadata mapping in the vfs context).","commonSituations":"Running nodeup outside a real EC2 instance (e.g. in a container, CI, or on-prem); IMDS disabled or set to require tokens with a low hop limit behind a proxy/NAT; network firewall blocking 169.254.169.254; using the AWS provider on a non-AWS machine during testing.","solutions":["Verify the machine is a real EC2 instance and IMDS is enabled: curl -s http://169.254.169.254/latest/meta-data/instance-id","If using IMDSv2, check the hop limit is >= 2 when nodeup runs behind a container/proxy (aws ec2 modify-instance-metadata-options --http-put-response-hop-limit 2)","Check no iptables/security-group rule blocks traffic to 169.254.169.254","If testing locally, run nodeup against the correct cloud provider or use --target dryrun on a real instance instead of forcing CloudProvider=AWS"],"exampleFix":"// before: nodeup running in a docker container on EC2 with default IMDSv2 hop limit 1\n// after: raise hop limit so containerized nodeup can fetch metadata\naws ec2 modify-instance-metadata-options --instance-id i-0abc123 \\\n  --http-tokens required --http-put-response-hop-limit 2","handlingStrategy":"retry","validationCode":"curl -s --max-time 2 http://169.254.169.254/latest/meta-data/instance-id || echo 'IMDS unreachable'","typeGuard":null,"tryCatchPattern":"if err := nodeupCmd.Run(ctx); err != nil {\n    if strings.Contains(err.Error(), \"error reading instance-id from AWS metadata\") {\n        // wait and re-run: IMDS may be transiently unavailable during boot\n        time.Sleep(5 * time.Second)\n        return retryNodeup()\n    }\n    return err\n}","preventionTips":["Keep IMDS enabled and reachable on all nodes that run nodeup","Set IMDSv2 hop limit >= 2 when nodeup runs inside a container/pod","Do not block 169.254.169.254 with host firewall rules","Only use CloudProvider=AWS on actual EC2 instances"],"tags":["aws","metadata","imds","nodeup"],"backgroundTag":"ec2-metadata-unreachable","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T07:17:12.445Z"}