{"record":{"id":"ab268b3d982e8138","repo":"VictoriaMetrics/VictoriaMetrics","slug":"cannot-read-gce-token-from-s-w","errorCode":null,"errorMessage":"cannot read GCE token from %s: %w","messagePattern":"cannot read GCE token from (.+?): %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"lib/promscrape/discovery/yandexcloud/api.go","lineNumber":168,"sourceCode":"\n// getGCEInstanceCreds gets Yandex Cloud IAM token using GCE API\n//\n// See https://yandex.cloud/en/docs/compute/operations/vm-connect/auth-inside-vm#auth-inside-vm\nfunc getGCEInstanceCreds(cfg *apiConfig) (*apiCredentials, error) {\n\tendpoint := \"http://169.254.169.254/computeMetadata/v1/instance/service-accounts/default/token\"\n\treq, err := http.NewRequest(http.MethodGet, endpoint, nil)\n\tif err != nil {\n\t\tlogger.Panicf(\"BUG: cannot create GCE token request for %s: %s\", endpoint, err)\n\t}\n\treq.Header.Add(\"Metadata-Flavor\", \"Google\")\n\n\tresp, err := cfg.client.Do(req)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"cannot obtain GCE token from %s: %w\", endpoint, err)\n\t}\n\tdata, err := readResponseBody(resp, endpoint)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"cannot read GCE token from %s: %w\", endpoint, err)\n\t}\n\n\tvar ac gceAPICredentials\n\tif err := json.Unmarshal(data, &ac); err != nil {\n\t\treturn nil, fmt.Errorf(\"cannot unmarshal GCE token from %s: %w; data=%s\", endpoint, err, data)\n\t}\n\tif ac.TokenType != \"Bearer\" {\n\t\treturn nil, fmt.Errorf(\"unsupported GCE token type received from %s: %q; supported: %q\", endpoint, ac.TokenType, \"Bearer\")\n\t}\n\n\texpiration := time.Now().Add(time.Duration(ac.ExpiresIn) * time.Second)\n\treturn &apiCredentials{\n\t\tToken:      ac.AccessToken,\n\t\tExpiration: expiration,\n\t}, nil\n}\n\n// See https://yandex.cloud/en/docs/compute/operations/vm-connect/auth-inside-vm#auth-inside-vm","sourceCodeStart":150,"sourceCodeEnd":186,"githubUrl":"https://github.com/VictoriaMetrics/VictoriaMetrics/blob/5079fb58f1e8e62113f90c945ad71586c797d770/lib/promscrape/discovery/yandexcloud/api.go#L150-L186","documentation":"After a successful HTTP response from the GCE-compatible metadata endpoint, readResponseBody must return the token JSON body. This error means the body could not be read: unexpected status code, empty/garbage body, or read/limit error inside readResponseBody. The endpoint is included to locate which metadata URL misbehaved.","triggerScenarios":"Metadata endpoint returned non-2xx with an unreadable/error body; response larger than the body size limit in readResponseBody; connection reset mid-body; endpoint returning empty body with 200 due to a misbehaving proxy.","commonSituations":"Intercepting proxies or service meshes stripping metadata responses; transient resets on the link-local interface; Yandex Cloud metadata API degraded; body size limit hit because an intermediary returned a huge HTML error page.","solutions":["Check the wrapped cause and status from readResponseBody for the concrete reason.","Bypass any proxy/service-mesh interception for metadata (link-local) traffic.","Retry — transient resets clear on the next credential refresh cycle.","If a body-size limit was hit, find what is returning the oversized body (usually a proxy error page).","Fall back to explicit yandex_passport_oauth_token if metadata remains unreliable."],"exampleFix":null,"handlingStrategy":"retry","validationCode":"client := &http.Client{Timeout: 5 * time.Second}\nresp, err := client.Get(metadataEndpoint)\nif err != nil {\n    return err\n}\ndefer resp.Body.Close()\nif resp.StatusCode != http.StatusOK {\n    return fmt.Errorf(\"metadata endpoint returned %d\", resp.StatusCode)\n}","typeGuard":null,"tryCatchPattern":"labels, err := sdc.GetLabels(baseDir)\nif err != nil {\n    if strings.Contains(err.Error(), \"cannot read GCE token\") {\n        // transient metadata read failure — retry after backoff\n        return retryWithBackoff(func() ([]*promutil.Labels, error) { return sdc.GetLabels(baseDir) })\n    }\n    return err\n}","preventionTips":["Exclude metadata (link-local) destinations from proxies and service meshes","Set reasonable timeouts so truncated reads fail fast and retry","Monitor metadata endpoint health from the scraper host","Keep an explicit OAuth token configured as backup auth"],"tags":["metadata","http-response","body-read","auth","yandexcloud-sd"],"backgroundTag":"metadata-response-invalid","analyzedSha":"5079fb58f1e8e62113f90c945ad71586c797d770","analyzedAt":"2026-09-03T18:10:26.153Z","contentChangedAt":"2026-09-03T18:10:26.153Z","schemaVersion":2},"datasetVersion":"2026-09-08T15:18:49.778Z"}