{"record":{"id":"be31152e5ef72879","repo":"kubernetes/kops","slug":"s-is-required-be3115","errorCode":null,"errorMessage":"%s is required","messagePattern":"(.+?) is required","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"critical","filePath":"upup/pkg/fi/cloudup/linode/verifier.go","lineNumber":50,"sourceCode":")\n\ntype LinodeVerifierOptions struct{}\n\ntype linodeVerifierClient interface {\n\tGetInstance(ctx context.Context, linodeID int) (*linodego.Instance, error)\n}\n\ntype linodeVerifier struct {\n\tclient linodeVerifierClient\n}\n\nvar _ bootstrap.Verifier = (*linodeVerifier)(nil)\n\n// NewLinodeVerifier returns a bootstrap.Verifier that can verify Akamai (Linode) instance tokens using the LINODE_TOKEN environment variable.\nfunc NewLinodeVerifier(opt *LinodeVerifierOptions) (bootstrap.Verifier, error) {\n\taccessToken := os.Getenv(\"LINODE_TOKEN\")\n\tif accessToken == \"\" {\n\t\treturn nil, fmt.Errorf(\"%s is required\", \"LINODE_TOKEN\")\n\t}\n\n\tclient, err := linodego.NewClient(nil)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"failed to create Linode client: %w\", err)\n\t}\n\tclient.SetUserAgent(\"kops\")\n\tclient.SetToken(accessToken)\n\n\treturn &linodeVerifier{client: &client}, nil\n}\n\n// VerifyToken verifies that the given token corresponds to a valid Akamai (Linode) instance.\nfunc (v *linodeVerifier) VerifyToken(ctx context.Context, rawRequest *http.Request, token string, body []byte) (*bootstrap.VerifyResult, error) {\n\tif !strings.HasPrefix(token, linodemetadata.LinodeAuthenticationTokenPrefix) {\n\t\treturn nil, bootstrap.ErrNotThisVerifier\n\t}\n","sourceCodeStart":32,"sourceCodeEnd":68,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/upup/pkg/fi/cloudup/linode/verifier.go#L32-L68","documentation":"NewLinodeVerifier builds a bootstrap.Verifier for Akamai (Linode) instance tokens and requires a Linode API access token. It reads LINODE_TOKEN from the environment; if the variable is unset or empty, construction fails immediately with '%s is required' where the placeholder is filled with LINODE_TOKEN. No Linode client can be created without credentials, so this is an intentional fail-fast guard.","triggerScenarios":"NewLinodeVerifier(opt) is called while os.Getenv(\"LINODE_TOKEN\") returns \"\" — the variable is not exported in the verifier's environment, is set to an empty string, or is defined only in a shell profile not loaded by the kOps process (e.g. systemd service, container).","commonSituations":"Running the verifier/bastion on a node where credentials were never provisioned; exporting LINODE_TOKEN in an interactive shell but launching kops via systemd/k8s which has a different env; CI jobs missing the secret in their env config; typo such as LINODE_API_TOKEN instead of LINODE_TOKEN.","solutions":["Export LINODE_TOKEN with a valid Linode API access token in the environment of the process running the verifier","If running under systemd or a container, add the env var to the unit file / container spec rather than the interactive shell","Check the exact variable name is LINODE_TOKEN (no typos or alternate names)","Verify with: echo \"${LINODE_TOKEN:?not set}\" before launching","In tests, set t.Setenv(\"LINODE_TOKEN\", \"dummy\") before calling NewLinodeVerifier"],"exampleFix":"// before (shell)\nkops executor verify --v=2\n// after (shell)\nexport LINODE_TOKEN=\"<linode-api-access-token>\"\nkops executor verify --v=2","handlingStrategy":"validation","validationCode":"if os.Getenv(\"LINODE_TOKEN\") == \"\" {\n\treturn errors.New(\"LINODE_TOKEN is required\")\n}","typeGuard":null,"tryCatchPattern":"verifier, err := linode.NewLinodeVerifier(opts)\nif err != nil {\n\tif strings.Contains(err.Error(), \"LINODE_TOKEN is required\") {\n\t\treturn fmt.Errorf(\"set LINODE_TOKEN in the service environment: %w\", err)\n\t}\n\treturn err\n}","preventionTips":["Fail fast at process startup if LINODE_TOKEN is unset: ${LINODE_TOKEN:?not set}","Configure the var in systemd units / container specs, not just interactive shells","Use the exact name LINODE_TOKEN","For tests use t.Setenv(\"LINODE_TOKEN\", \"test-token\")"],"tags":["env","config","linode","authentication"],"backgroundTag":"missing-env-var","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T07:17:12.445Z"}