{"record":{"id":"eb2020e9d8e301f0","repo":"kubernetes/kops","slug":"error-loading-aws-config-v","errorCode":null,"errorMessage":"error loading AWS config: %v","messagePattern":"error loading AWS config: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"nodeup/pkg/model/kubelet.go","lineNumber":121,"sourceCode":"func (b *KubeletBuilder) Build(c *fi.NodeupModelBuilderContext) error {\n\terr := b.buildKubeletServingCertificate(c)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"error building kubelet server cert: %v\", err)\n\t}\n\n\tctx := c.Context()\n\tkubeletConfig, err := b.buildKubeletConfigSpec(ctx)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"error building kubelet config: %v\", err)\n\t}\n\n\t{\n\t\t// Set the provider ID to help speed node registration on large clusters\n\t\tvar providerID string\n\t\tif b.CloudProvider() == kops.CloudProviderAWS {\n\t\t\tconfig, err := awsconfig.LoadDefaultConfig(ctx)\n\t\t\tif err != nil {\n\t\t\t\treturn fmt.Errorf(\"error loading AWS config: %v\", err)\n\t\t\t}\n\t\t\tmetadata := imds.NewFromConfig(config)\n\t\t\tinstanceIdentity, err := metadata.GetInstanceIdentityDocument(ctx, &imds.GetInstanceIdentityDocumentInput{})\n\t\t\tif err != nil {\n\t\t\t\treturn err\n\t\t\t}\n\t\t\tproviderID = fmt.Sprintf(\"aws:///%s/%s\", instanceIdentity.AvailabilityZone, instanceIdentity.InstanceID)\n\t\t} else if b.CloudProvider() == kops.CloudProviderAzure {\n\t\t\tmetadata, err := azuremetadata.QueryComputeInstanceMetadata(ctx)\n\t\t\tif err != nil {\n\t\t\t\treturn fmt.Errorf(\"error querying Azure instance metadata: %v\", err)\n\t\t\t}\n\t\t\tproviderID = \"azure://\" + metadata.ResourceID\n\t\t} else if b.CloudProvider() == kops.CloudProviderDO {\n\t\t\t// The DO CCM resolves nodes by provider ID; its name-based fallback does not match\n\t\t\t// our IP-based node names.\n\t\t\tdropletID, err := dometadata.GetDropletID()\n\t\t\tif err != nil {","sourceCodeStart":103,"sourceCodeEnd":139,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/nodeup/pkg/model/kubelet.go#L103-L139","documentation":"When the cluster's cloud provider is AWS, KubeletBuilder.Build loads the AWS SDK default config (awsconfig.LoadDefaultConfig) to query EC2 instance identity metadata and construct the node providerID. Failure to load the AWS config chain is wrapped with this message.","triggerScenarios":"awsconfig.LoadDefaultConfig fails on an AWS node — no credentials/config resolution at all and IMDS unavailable, so the SDK config cannot be constructed.","commonSituations":"IMDS hop limit too low / IMDS disabled on the instance, missing or corrupt shared config files with parse errors, or badly set AWS_* environment variables on the node.","solutions":["Ensure IMDSv2 is reachable (hop limit >= 2 for containerized nodeup, metadata options enabled).","Check AWS_* environment variables and ~/.aws config files on the node for invalid values.","Verify the instance has an instance profile / can reach the EC2 metadata service (169.254.169.254).","Read the wrapped inner error to identify which config source failed."],"exampleFix":"// before (IMDS hop limit 1 blocks nodeup in container)\nHttpTokens: required, HttpPutResponseHopLimit: 1\n// after\nHttpTokens: required, HttpPutResponseHopLimit: 2","handlingStrategy":"try-catch","validationCode":"// on the node, before nodeup: confirm IMDS reachable\ntoken=$(curl -sf -X PUT -m 2 http://169.254.169.254/latest/api/token -H 'X-aws-ec2-metadata-token-ttl-seconds: 60') || echo \"IMDS unreachable\"","typeGuard":null,"tryCatchPattern":"var cfgErr *aws.Config\nerr := runNodeup(ctx)\nif err != nil && strings.Contains(err.Error(), \"error loading AWS config\") {\n    // check IMDS hop limit / AWS env vars, then retry\n    return fmt.Errorf(\"aws metadata unavailable: %w\", err)\n}","preventionTips":["Set IMDSv2 hop limit >= 2 when nodeup runs in a container/Pod.","Keep AWS_* env vars off or valid on worker nodes.","Verify instance profiles are attached before bootstrapping."],"tags":["nodeup","aws","metadata","kubelet"],"backgroundTag":"aws-config-load-failed","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T07:17:12.445Z"}