{"record":{"id":"9a29cc05ff5cb8b0","repo":"kubernetes/kops","slug":"failed-to-get-info-for-akamai-linode-instance-q-9a29cc","errorCode":null,"errorMessage":"failed to get info for Akamai (Linode) instance %q: %w","messagePattern":"failed to get info for Akamai \\(Linode\\) instance %q: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"upup/pkg/fi/cloudup/linode/verifier.go","lineNumber":77,"sourceCode":"\n\treturn &linodeVerifier{client: &client}, nil\n}\n\n// VerifyToken verifies that the given token corresponds to a valid Akamai (Linode) instance.\nfunc (v *linodeVerifier) VerifyToken(ctx context.Context, rawRequest *http.Request, token string, body []byte) (*bootstrap.VerifyResult, error) {\n\tif !strings.HasPrefix(token, linodemetadata.LinodeAuthenticationTokenPrefix) {\n\t\treturn nil, bootstrap.ErrNotThisVerifier\n\t}\n\n\tinstanceIDString := strings.TrimPrefix(token, linodemetadata.LinodeAuthenticationTokenPrefix)\n\tinstanceID, err := strconv.Atoi(instanceIDString)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"invalid authorization token\")\n\t}\n\n\tinstance, err := v.client.GetInstance(ctx, instanceID)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"failed to get info for Akamai (Linode) instance %q: %w\", instanceIDString, err)\n\t}\n\tif instance == nil {\n\t\treturn nil, fmt.Errorf(\"failed to get info for Akamai (Linode) instance %q: empty response\", instanceIDString)\n\t}\n\n\taddresses, challengeEndpoints := gatherIPv4Addresses(instance.IPv4)\n\tif len(challengeEndpoints) == 0 {\n\t\treturn nil, fmt.Errorf(\"cannot determine challenge endpoint for instance id: %s\", instanceIDString)\n\t}\n\n\tresult := &bootstrap.VerifyResult{\n\t\tNodeName:          instance.Label,\n\t\tInstanceGroupName: instanceGroupNameFromTags(instance.Tags),\n\t\tCertificateNames:  addresses,\n\t\tChallengeEndpoint: challengeEndpoints[0],\n\t}\n\n\treturn result, nil","sourceCodeStart":59,"sourceCodeEnd":95,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/upup/pkg/fi/cloudup/linode/verifier.go#L59-L95","documentation":"After parsing the instance ID, VerifyToken calls v.client.GetInstance(ctx, instanceID) against the Linode API. If the API call returns an error (invalid/expired API token, network failure, nonexistent instance, 4xx/5xx), it is wrapped with this message including the instance ID string. This error means the verifier could not retrieve authoritative instance data from the Linode API.","triggerScenarios":"GetInstance fails because LINODE_TOKEN is invalid/revoked/lacks scopes; the instance ID does not exist or belongs to another account; network egress from the verifier to api.linode.com is blocked; API rate limiting or outage.","commonSituations":"Expired or rotated LINODE_TOKEN in the verifier environment; token for a different Linode account than the one owning the instance; firewall/proxy blocking outbound 443 to api.linode.com; 429 rate-limit during bulk verification.","solutions":["Inspect the wrapped error: 401/403 => replace LINODE_TOKEN with a valid token with read scope for the instance's account","Confirm the instance ID exists in the same Linode account as the token (linode-cli linodes list)","Verify outbound HTTPS access to api.linode.com from the verifier host","Retry on transient errors (5xx/429) with backoff","Check linodego/API status if the failure is widespread"],"exampleFix":null,"handlingStrategy":"retry","validationCode":"// pre-check credentials and instance existence\nif os.Getenv(\"LINODE_TOKEN\") == \"\" { return errors.New(\"LINODE_TOKEN not set\") }\ncli := linodego.NewClient(nil); cli.SetToken(os.Getenv(\"LINODE_TOKEN\"))\nif _, err := cli.GetInstance(context.Background(), instanceID); err != nil { return err }","typeGuard":null,"tryCatchPattern":"result, err := verifier.VerifyToken(ctx, token, certs, challenge)\nif err != nil {\n\tvar apiErr *linodego.Error\n\tif errors.As(err, &apiErr) && (apiErr.Code == 429 || apiErr.Code >= 500) {\n\t\treturn retryWithBackoff(err)\n\t}\n\treturn err\n}","preventionTips":["Rotate and scope LINODE_TOKEN properly (read access to the right account)","Monitor connectivity to api.linode.com from verifier hosts","Implement retry with backoff for 429/5xx","Confirm instance IDs belong to the same Linode account as the token"],"tags":["linode","api","authentication","network"],"backgroundTag":"api-request-failed","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T07:17:12.445Z"}