{"record":{"id":"fa1681b915693992","repo":"kubernetes/kops","slug":"querying-imds-s-w","errorCode":null,"errorMessage":"querying IMDS %s: %w","messagePattern":"querying IMDS (.+?): %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"critical","filePath":"upup/pkg/fi/cloudup/azure/azuremetadata/imds.go","lineNumber":80,"sourceCode":"}\n\n// queryIMDS queries an Azure IMDS endpoint and unmarshals the JSON response.\n// https://learn.microsoft.com/en-us/azure/virtual-machines/instance-metadata-service\nfunc queryIMDS(ctx context.Context, path string, params url.Values, result any) error {\n\treq, err := http.NewRequestWithContext(ctx, \"GET\", imdsBaseURL+path, nil)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"creating IMDS request: %w\", err)\n\t}\n\treq.Header.Add(\"Metadata\", \"True\")\n\n\tparams.Set(\"api-version\", imdsAPIVersion)\n\treq.URL.RawQuery = params.Encode()\n\n\tklog.V(4).Infof(\"Azure IMDS query: %q\", req.URL.String())\n\n\tresp, err := imdsHTTPClient.Do(req)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"querying IMDS %s: %w\", path, err)\n\t}\n\tdefer resp.Body.Close()\n\n\tif resp.StatusCode != http.StatusOK {\n\t\treturn fmt.Errorf(\"querying IMDS %s: status %d\", path, resp.StatusCode)\n\t}\n\n\tbody, err := io.ReadAll(resp.Body)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"reading IMDS response: %w\", err)\n\t}\n\tklog.V(4).Infof(\"Azure IMDS response: %d bytes\", len(body))\n\n\tif err := json.Unmarshal(body, result); err != nil {\n\t\treturn fmt.Errorf(\"unmarshalling IMDS response: %w\", err)\n\t}\n\n\treturn nil","sourceCodeStart":62,"sourceCodeEnd":98,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/upup/pkg/fi/cloudup/azure/azuremetadata/imds.go#L62-L98","documentation":"queryIMDS wraps errors from imdsHTTPClient.Do(req) with \"querying IMDS <path>\": the HTTP request to the Azure Instance Metadata Service at http://169.254.169.254 did not complete (transport-level failure). This is the classic \"IMDS unreachable\" family — DNS/connection/routing/timeouts on the link-local address.","triggerScenarios":"Any queryIMDS call (from QueryComputeInstanceMetadata or queryIMDSAttestedDocument) where the client fails: connection refused/timeout (10s client timeout), network unreachable, context cancellation, or TLS/proxy misconfig (proxy is explicitly disabled).","commonSituations":"Non-Azure environments (local dev, CI, on-prem, other clouds) where 169.254.169.254 is unroutable; NSG/firewall blocking link-local; IMDS temporarily unavailable at VM boot; heavily throttled IMDS dropping connections.","solutions":["Confirm IMDS reachability with curl -H Metadata:true 'http://169.254.169.254/metadata/instance/compute?api-version=2025-04-07&format=json'","If off-Azure, don't run the IMDS-backed authenticator — use the appropriate authenticator for the environment","Retry with backoff if transient (boot-time race, throttling)","Check iptables/NSG rules and routes for the link-local prefix"],"exampleFix":null,"handlingStrategy":"retry","validationCode":"// Cheap pre-check that the link-local IMDS address is routable\nconn, err := net.DialTimeout(\"tcp\", \"169.254.169.254:80\", 3*time.Second)\nif err != nil { return fmt.Errorf(\"IMDS not reachable from this host: %w\", err) }\nconn.Close()","typeGuard":null,"tryCatchPattern":"// Distinguish transport failure and retry with capped backoff\nvar lastErr error\nfor i := 0; i < 5; i++ {\n    token, err := auth.CreateToken(body)\n    if err == nil { return token, nil }\n    lastErr = err\n    if errors.Is(err, context.DeadlineExceeded) || isNetTimeout(err) {\n        time.Sleep(time.Duration(1<<i) * time.Second)\n        continue\n    }\n    break\n}\nreturn \"\", lastErr","preventionTips":["Run IMDS-dependent code only on Azure VMs; use feature detection or provider config otherwise","Ensure NSG/firewall never blocks 169.254.169.254 (link-local is permitted by default)","Expect IMDS flakiness at boot; always wrap bootstrap calls in retry/backoff","Keep Proxy disabled for IMDS clients (as this library does)"],"tags":["azure","imds","network","connection-refused","timeout"],"backgroundTag":"connection-refused","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T07:17:12.445Z"}