{"record":{"id":"ed41df88694ccf26","repo":"k3s-io/k3s","slug":"s-s","errorCode":null,"errorMessage":"%s: %s","messagePattern":"%s: %s","errorType":"console","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/agent/config/config.go","lineNumber":184,"sourceCode":"\t\t// This allows us to fall back from node identity to token when the node resource is deleted.\n\t\tif resp.StatusCode == http.StatusUnauthorized {\n\t\t\tif transport, ok := client.Transport.(*http.Transport); ok && transport.TLSClientConfig != nil && len(transport.TLSClientConfig.Certificates) != 0 {\n\t\t\t\tlogrus.Infof(\"Node authorization rejected, retrying without client certificate authentication\")\n\t\t\t\ttransport.TLSClientConfig.Certificates = []tls.Certificate{}\n\t\t\t\tresp, err = client.Do(req)\n\t\t\t\tif err != nil {\n\t\t\t\t\treturn nil, err\n\t\t\t\t}\n\t\t\t\tdefer resp.Body.Close()\n\t\t\t}\n\t\t}\n\n\t\tif resp.StatusCode == http.StatusForbidden {\n\t\t\treturn nil, fmt.Errorf(\"Node password rejected, duplicate hostname or contents of '%s' may not match server node-passwd entry, try enabling a unique node name with the --with-node-id flag\", nodePasswordFile)\n\t\t}\n\n\t\tif resp.StatusCode != http.StatusOK {\n\t\t\treturn nil, fmt.Errorf(\"%s: %s\", u, resp.Status)\n\t\t}\n\n\t\treturn io.ReadAll(resp.Body)\n\t}\n}\n\nfunc ensureNodeID(nodeIDFile string) (string, error) {\n\tif _, err := os.Stat(nodeIDFile); err == nil {\n\t\tid, err := os.ReadFile(nodeIDFile)\n\t\treturn strings.TrimSpace(string(id)), err\n\t}\n\tid := make([]byte, 4, 4)\n\t_, err := cryptorand.Read(id)\n\tif err != nil {\n\t\treturn \"\", err\n\t}\n\tnodeID := hex.EncodeToString(id)\n\treturn nodeID, os.WriteFile(nodeIDFile, []byte(nodeID+\"\\n\"), 0644)","sourceCodeStart":166,"sourceCodeEnd":202,"githubUrl":"https://github.com/k3s-io/k3s/blob/6ba341e396edc16b8dcae978a7c5e3ac7ee5606e/pkg/agent/config/config.go#L166-L202","documentation":"Catch-all for the agent's config download when the HTTP status is anything other than 200 (403 gets the dedicated node-password error above): the error is just '<request-url>: <resp.Status>'. All diagnostics live in the URL and status code, e.g. 'https://10.0.0.1:6443/v1-k3s/configs: 503 Service Unavailable'.","triggerScenarios":"resp.StatusCode != 200 && != 403 on the config fetch: 401 (invalid node password/token), 503 (server/API server not ready, or the agent's internal load balancer has no healthy backend), 500 (server-side fault), 404 (path/version skew).","commonSituations":"Agents racing a still-starting server; wrong --server address or port; expired/rotated node token; load balancer pointing at a dead server; apiserver crashlooping.","solutions":["Read the status from the message: 401 -> fix the token/node-password; 503 -> wait and check server health; 404/500 -> inspect server version and logs","Verify reachability: curl -k https://<server>:6443/ping or /readyz","Re-check the --server URL and port","Check server-side logs if the status persists"],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":"if err != nil {\n    if strings.Contains(err.Error(), \": 503\") || strings.Contains(err.Error(), \": 401\") {\n    // 503: back off and retry (server may still be starting)\n    // 401: fix credentials — retrying will not help\n    }\n}","preventionTips":["Poll the server's /readyz before starting agents to avoid 503 races","Automate token validation so 401s surface at deploy time","Log the full '<url>: <status>' message — the URL and status carry all the diagnostics"],"tags":["http","connection","agent","status","server"],"backgroundTag":null,"analyzedSha":"6ba341e396edc16b8dcae978a7c5e3ac7ee5606e","analyzedAt":"2026-08-15T16:27:54.286Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}