{"record":{"id":"c7b68853f98531f4","repo":"kubernetes/kops","slug":"unable-to-fetch-metadata-w","errorCode":null,"errorMessage":"unable to fetch metadata: %w","messagePattern":"unable to fetch metadata: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"upup/pkg/fi/cloudup/openstack/openstackmetadata/authenticator.go","lineNumber":39,"sourceCode":"\n\t\"k8s.io/kops/pkg/bootstrap\"\n)\n\nconst OpenstackAuthenticationTokenPrefix = \"x-openstack-id \" //nolint:gosec // This is an authentication scheme prefix, not a credential.\n\ntype openstackAuthenticator struct {\n}\n\nvar _ bootstrap.Authenticator = (*openstackAuthenticator)(nil)\n\nfunc NewOpenstackAuthenticator() (bootstrap.Authenticator, error) {\n\treturn &openstackAuthenticator{}, nil\n}\n\nfunc (o *openstackAuthenticator) CreateToken(body []byte) (string, error) {\n\tmetadata, err := GetLocalMetadata()\n\tif err != nil {\n\t\treturn \"\", fmt.Errorf(\"unable to fetch metadata: %w\", err)\n\t}\n\treturn OpenstackAuthenticationTokenPrefix + metadata.ServerID, nil\n}\n","sourceCodeStart":21,"sourceCodeEnd":43,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/upup/pkg/fi/cloudup/openstack/openstackmetadata/authenticator.go#L21-L43","documentation":"CreateToken (upup/pkg/fi/cloudup/openstack/openstackmetadata/authenticator.go:39) builds an authentication token from the instance's local metadata (ServerID). If GetLocalMetadata fails — because neither the config drive nor the metadata service could be read — the underlying error is wrapped with this message.","triggerScenarios":"GetLocalMetadata() returns an error: blkid cannot find a config-drive device, the config drive cannot be mounted/read, the metadata service HTTP request fails or returns non-200, or the configured search order contains invalid options.","commonSituations":"Node bootstrapping on an OpenStack VM where the config drive was not attached at instance creation; the nova metadata service is unreachable from the instance network; the instance was created without config_drive enabled while metadata service is firewalled.","solutions":["Ensure the instance was booted with a config drive (nova boot --config-drive true or the flavor/image default) or that the metadata service (169.254.169.254) is reachable.","Inspect the wrapped cause (%w) in the error chain to see whether it came from getFromConfigDrive or getFromMetadataService.","Verify the metadata search order configured on the instance only contains 'configDrive' and 'metadataService'.","Check network/security-group rules allow egress to the metadata service endpoint."],"exampleFix":"// before\nmetadata, err := GetLocalMetadata()\nif err != nil {\n    return \"\", fmt.Errorf(\"unable to fetch metadata: %w\", err)\n}\n// after — surface which source failed for faster diagnosis\nmetadata, err := GetLocalMetadata()\nif err != nil {\n    return \"\", fmt.Errorf(\"unable to fetch metadata (check config drive attachment and 169.254.169.254 reachability): %w\", err)\n}","handlingStrategy":"fallback","validationCode":"// Check that at least one metadata source is plausibly available\nif _, err := os.Stat(\"/dev/disk/by-label/\" + \"config-2\"); err != nil {\n    resp, err := http.Get(\"http://169.254.169.254/openstack/latest/meta_data.json\")\n    if err != nil || resp.StatusCode != http.StatusOK {\n        return errors.New(\"neither config drive nor metadata service is reachable\")\n    }\n}","typeGuard":null,"tryCatchPattern":"token, err := authenticator.CreateToken(body)\nif err != nil {\n    var pathErr *fs.PathError\n    if errors.As(err, &pathErr) {\n        // config-drive read failed — fall back to metadata-service-only mode\n    }\n    return fmt.Errorf(\"token creation failed, metadata source unavailable: %w\", err)\n}","preventionTips":["Boot instances with --config-drive true so local metadata is always present.","Keep egress to 169.254.169.254 unblocked in instance security groups.","Unwrap the %w error chain to identify which source (config drive vs metadata service) failed.","Test metadata availability as a node bootstrap preflight step."],"tags":["openstack","metadata","authentication","instance"],"backgroundTag":"instance-metadata-unavailable","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T07:17:12.445Z"}