{"record":{"id":"b384c6b296e35baa","repo":"kubernetes/kops","slug":"fetching-metadata-token-unexpected-status-code-d","errorCode":null,"errorMessage":"fetching metadata token: unexpected status code %d","messagePattern":"fetching metadata token: unexpected status code (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"upup/pkg/fi/cloudup/linode/linodemetadata/authenticator.go","lineNumber":89,"sourceCode":"}\n\n// getLinodeMetadataValue queries the Akamai (Linode) metadata service for the given key\n// and returns the value as a string.\nfunc getLinodeMetadataValue(ctx context.Context, client *http.Client, metadataBaseURL, key string) (string, error) {\n\ttokenReq, err := http.NewRequestWithContext(ctx, http.MethodPut, metadataBaseURL+\"/v1/token\", nil)\n\tif err != nil {\n\t\treturn \"\", fmt.Errorf(\"building metadata token request: %w\", err)\n\t}\n\ttokenReq.Header.Set(\"Metadata-Token-Expiry-Seconds\", linodeMetadataTokenTTL)\n\n\ttokenResp, err := client.Do(tokenReq)\n\tif err != nil {\n\t\treturn \"\", fmt.Errorf(\"fetching metadata token: %w\", err)\n\t}\n\tdefer tokenResp.Body.Close()\n\n\tif tokenResp.StatusCode != http.StatusOK {\n\t\treturn \"\", fmt.Errorf(\"fetching metadata token: unexpected status code %d\", tokenResp.StatusCode)\n\t}\n\n\ttokenBytes, err := io.ReadAll(tokenResp.Body)\n\tif err != nil {\n\t\treturn \"\", fmt.Errorf(\"reading metadata token response: %w\", err)\n\t}\n\n\ttoken := strings.TrimSpace(string(tokenBytes))\n\tif token == \"\" {\n\t\treturn \"\", fmt.Errorf(\"metadata token was empty\")\n\t}\n\n\tinstanceReq, err := http.NewRequestWithContext(ctx, http.MethodGet, metadataBaseURL+\"/v1/instance\", nil)\n\tif err != nil {\n\t\treturn \"\", fmt.Errorf(\"building instance metadata request: %w\", err)\n\t}\n\tinstanceReq.Header.Set(\"Metadata-Token\", token)\n","sourceCodeStart":71,"sourceCodeEnd":107,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/upup/pkg/fi/cloudup/linode/linodemetadata/authenticator.go#L71-L107","documentation":"getLinodeMetadataValue rejects the token-issuance response because the PUT /v1/token call returned a non-200 status. It fires when the Linode metadata service refuses to mint a token (rate limiting, metadata disabled, service error), so the caller cannot proceed to read instance metadata.","triggerScenarios":"Thrown at upup/pkg/fi/cloudup/linode/linodemetadata/authenticator.go:89 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Check the reported status code: 403/404 usually means the metadata service is disabled for the instance","Retry after backoff on 429/5xx responses","Verify the Metadata-Token-Expiry-Seconds header value is acceptable to the service"],"exampleFix":null,"handlingStrategy":"retry","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T07:17:12.445Z"}