{"record":{"id":"f3f46cb714b090b9","repo":"kubernetes/kops","slug":"getting-instance-metadata-w","errorCode":null,"errorMessage":"getting instance metadata: %w","messagePattern":"getting instance metadata: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"upup/pkg/fi/cloudup/azure/verifier.go","lineNumber":296,"sourceCode":"\t}\n\treturn addrs, challengeEndpoints, nil\n}\n\n// client is an Azure client.\ntype client struct {\n\tsubscriptionID string\n\tresourceGroup  string\n\tnisClient      *network.InterfacesClient\n\tvmsClient      *compute.VirtualMachinesClient\n\tvmssVMsClient  *compute.VirtualMachineScaleSetVMsClient\n}\n\n// newVerifierClient builds Azure API clients scoped to the local instance's subscription and\n// resource group from IMDS metadata.\nfunc newVerifierClient(ctx context.Context) (*client, error) {\n\tmetadata, err := azuremetadata.QueryComputeInstanceMetadata(ctx)\n\tif err != nil || metadata == nil {\n\t\treturn nil, fmt.Errorf(\"getting instance metadata: %w\", err)\n\t}\n\tif metadata.ResourceGroupName == \"\" {\n\t\treturn nil, fmt.Errorf(\"empty resource group name\")\n\t}\n\tif metadata.SubscriptionID == \"\" {\n\t\treturn nil, fmt.Errorf(\"empty subscription ID\")\n\t}\n\tklog.V(4).Infof(\"Azure verifier client using subscription %q resource group %q\", metadata.SubscriptionID, metadata.ResourceGroupName)\n\n\tcred, err := azidentity.NewDefaultAzureCredential(nil)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"creating an identity: %w\", err)\n\t}\n\n\tnisClient, err := network.NewInterfacesClient(metadata.SubscriptionID, cred, nil)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"creating interfaces client: %w\", err)\n\t}","sourceCodeStart":278,"sourceCodeEnd":314,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/upup/pkg/fi/cloudup/azure/verifier.go#L278-L314","documentation":"newVerifierClient bootstraps Azure API clients from the local instance's IMDS compute metadata. If azuremetadata.QueryComputeInstanceMetadata returns an error or nil metadata, the verifier cannot scope itself and wraps the cause with this message.","triggerScenarios":"QueryComputeInstanceMetadata fails (IMDS unreachable, timeout, non-200 response, malformed JSON) or returns nil, e.g. when run off-cloud or before the NIC/IMDS route is available; note that a non-nil err with nil metadata also produces a wrapped nil-pointer detail.","commonSituations":"Node runs in an environment without Azure IMDS (local dev, non-Azure CI); IMDS blocked by iptables/proxy or 169.254.169.254 route missing; IMDS not yet ready seconds after VM boot (429/503 during warm-up); kOps verifier running where managed identity is absent.","solutions":["Verify IMDS works from the node: curl -H Metadata:true 'http://169.254.169.254/metadata/instance/compute?api-version=2021-02-01' — fix routing/firewall if not","If the VM just booted, retry — IMDS returns 429/503 until ready","Confirm the verifier only runs on Azure nodes; run kops control-plane verifier components on Azure infrastructure","Check the metadata API version used by azuremetadata is still supported by the region"],"exampleFix":null,"handlingStrategy":"retry","validationCode":"req, _ := http.NewRequest(\"GET\", \"http://169.254.169.254/metadata/instance/compute?api-version=2021-02-01\", nil)\nreq.Header.Set(\"Metadata\", \"true\")\n// if this fails or times out, IMDS is unavailable; don't attempt verification","typeGuard":null,"tryCatchPattern":"metadata, err := azuremetadata.QueryComputeInstanceMetadata(ctx)\nif err != nil || metadata == nil {\n\t// retry with backoff: IMDS is often not ready right after boot (429/503)\n}","preventionTips":["Ensure 169.254.169.254 is routed and not proxied on nodes","Add boot-time retry/backoff around IMDS queries","Only run verifier components on Azure infrastructure","Pin a supported IMDS api-version"],"tags":["azure","imds","metadata","boot"],"backgroundTag":"imds-unavailable","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T07:17:12.445Z"}