{"record":{"id":"8854eb6b8f5e0747","repo":"kubernetes/kops","slug":"unknown-metadata-type-q-in-q","errorCode":null,"errorMessage":"unknown metadata type: %q in %q","messagePattern":"unknown metadata type: %q in %q","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"util/pkg/vfs/context.go","lineNumber":152,"sourceCode":"\n\t\tswitch u.Scheme {\n\t\tcase \"metadata\":\n\t\t\tswitch u.Host {\n\t\t\tcase \"gce\":\n\t\t\t\thttpURL := \"http://169.254.169.254/computeMetadata/v1/\" + u.Path\n\t\t\t\thttpHeaders := make(map[string]string)\n\t\t\t\thttpHeaders[\"Metadata-Flavor\"] = \"Google\"\n\t\t\t\treturn c.readHTTPLocation(httpURL, httpHeaders, opts)\n\t\t\tcase \"aws\":\n\t\t\t\treturn c.readAWSMetadata(ctx, u.Path)\n\t\t\tcase \"digitalocean\":\n\t\t\t\thttpURL := \"http://169.254.169.254/metadata/v1\" + u.Path\n\t\t\t\treturn c.readHTTPLocation(httpURL, nil, opts)\n\t\t\tcase \"openstack\":\n\t\t\t\thttpURL := \"http://169.254.169.254/latest/meta-data/\" + u.Path\n\t\t\t\treturn c.readHTTPLocation(httpURL, nil, opts)\n\t\t\tdefault:\n\t\t\t\treturn nil, fmt.Errorf(\"unknown metadata type: %q in %q\", u.Host, location)\n\t\t\t}\n\n\t\tcase \"http\", \"https\":\n\t\t\treturn c.readHTTPLocation(location, nil, opts)\n\t\t}\n\t}\n\n\tlocation = strings.TrimPrefix(location, \"file://\")\n\n\tp, err := c.BuildVfsPath(location)\n\tif err != nil {\n\t\treturn nil, err\n\t}\n\treturn p.ReadFile(ctx)\n}\n\nfunc (c *VFSContext) BuildVfsPath(p string) (Path, error) {\n\t// NOTE: we do not want this function to take a context.Context, we consider this a \"builder\".","sourceCodeStart":134,"sourceCodeEnd":170,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/util/pkg/vfs/context.go#L134-L170","documentation":"When ReadFile sees a metadata:// URL, it dispatches on u.Host to a known cloud metadata provider (gce, aws, digitalocean, openstack). If the host segment names no supported provider, the library has no metadata endpoint mapping and returns this error.","triggerScenarios":"Calling ReadFile with metadata://<unknown-host>/... - e.g. metadata://azure/instance/compute, metadata://aliyun/meta-data/instance-id, or metadata:///instance-id (empty host, because the second slash set is missing so the path lands in Host incorrectly).","commonSituations":"Porting scripts written for another cloud to kOps; mistyping the provider name; forgetting that azure is not supported in the metadata scheme and using metadata://azure instead of the azure IMDS URL directly.","solutions":["Use one of the supported hosts: metadata://gce/..., metadata://aws/..., metadata://digitalocean/..., metadata://openstack/...","Check spelling/casing of the provider segment immediately after metadata://","For unsupported clouds, query the metadata service directly via its http(s) URL instead of the metadata scheme","If you need a new provider, extend the switch in VFSContext.ReadFile in util/pkg/vfs/context.go"],"exampleFix":"// before\nvfs.Context.ReadFile(\"metadata://azure/instance/compute\")\n// after\nvfs.Context.ReadFile(\"metadata://openstack/latest/meta-data/instance-id\") // supported host","handlingStrategy":"validation","validationCode":"var supportedMetadataHosts = map[string]bool{\"gce\": true, \"aws\": true, \"digitalocean\": true, \"openstack\": true}\nfunc validateMetadataURL(loc string) error {\n\tu, err := url.Parse(loc)\n\tif err != nil || u.Scheme != \"metadata\" {\n\t\treturn nil // not this error's concern\n\t}\n\tif !supportedMetadataHosts[u.Host] {\n\t\treturn fmt.Errorf(\"unsupported metadata host %q (supported: gce, aws, digitalocean, openstack)\", u.Host)\n\t}\n\treturn nil\n}","typeGuard":"func isKnownMetadataHost(loc string) bool {\n\tu, err := url.Parse(loc)\n\treturn err == nil && u.Scheme == \"metadata\" &&\n\t\t(u.Host == \"gce\" || u.Host == \"aws\" || u.Host == \"digitalocean\" || u.Host == \"openstack\")\n}","tryCatchPattern":"data, err := vfs.Context.ReadFile(loc)\nif err != nil && strings.Contains(err.Error(), \"unknown metadata type\") {\n\treturn fmt.Errorf(\"metadata scheme supports only gce/aws/digitalocean/openstack: %w\", err)\n}","preventionTips":["Keep a whitelist constant of supported metadata hosts and check against it at config load time","Test the metadata URL in CI before deploying cluster configs","Query unsupported clouds' IMDS directly over http://169.254.169.254 instead"],"tags":["vfs","metadata","unsupported-provider"],"backgroundTag":"unsupported-scheme","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T07:17:12.445Z"}