{"record":{"id":"fd8e5df1da6fbaa5","repo":"kubernetes/kops","slug":"failed-to-get-local-ipv4-address-from-ec2-metadata","errorCode":null,"errorMessage":"failed to get local-ipv4 address from ec2 metadata: %w","messagePattern":"failed to get local-ipv4 address from ec2 metadata: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"nodeup/pkg/model/context.go","lineNumber":600,"sourceCode":"// RunningOnAzure returns true if we are running on Azure\nfunc (c *NodeupModelContext) RunningOnAzure() bool {\n\treturn c.CloudProvider() == kops.CloudProviderAzure\n}\n\n// GetMetadataLocalIP returns the local IP address read from metadata\nfunc (c *NodeupModelContext) GetMetadataLocalIP(ctx context.Context) (string, error) {\n\tvar internalIP string\n\n\tswitch c.BootConfig.CloudProvider {\n\tcase kops.CloudProviderAWS:\n\t\tconfig, err := awsconfig.LoadDefaultConfig(ctx)\n\t\tif err != nil {\n\t\t\treturn \"\", fmt.Errorf(\"failed to load AWS config: %w\", err)\n\t\t}\n\t\tmetadata := imds.NewFromConfig(config)\n\t\tlocalIPv4, err := getMetadata(ctx, metadata, \"local-ipv4\")\n\t\tif err != nil {\n\t\t\treturn \"\", fmt.Errorf(\"failed to get local-ipv4 address from ec2 metadata: %w\", err)\n\t\t}\n\t\tinternalIP = localIPv4\n\n\tcase kops.CloudProviderHetzner:\n\t\tclient := hcloudmetadata.NewClient()\n\t\tprivateNetworksYaml, err := client.PrivateNetworks()\n\t\tif err != nil {\n\t\t\treturn \"\", fmt.Errorf(\"failed to get private networks from hetzner cloud metadata: %w\", err)\n\t\t}\n\t\tvar privateNetworks []struct {\n\t\t\tIP           net.IP   `json:\"ip\"`\n\t\t\tAliasIPs     []net.IP `json:\"alias_ips\"`\n\t\t\tInterfaceNum int      `json:\"interface_num\"`\n\t\t\tMACAddress   string   `json:\"mac_address\"`\n\t\t\tNetworkID    int      `json:\"network_id\"`\n\t\t\tNetworkName  string   `json:\"network_name\"`\n\t\t\tNetwork      string   `json:\"network\"`\n\t\t\tSubnet       string   `json:\"subnet\"`","sourceCodeStart":582,"sourceCodeEnd":618,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/nodeup/pkg/model/context.go#L582-L618","documentation":"After loading AWS config, GetMetadataLocalIP queries EC2 IMDS for local-ipv4 via getMetadata; any failure (timeout, 404, IMDSv2 token error) is wrapped with this message. nodeup needs this IP as the node's internal address (e.g. for server certs and systemd env files).","triggerScenarios":"getMetadata(ctx, imds client, \"local-ipv4\") returns an error: IMDS unreachable (169.254.169.254 blocked), IMDSv2 token fetch fails due to hop limit, or the request times out during node bootstrap.","commonSituations":"Security groups/host firewall blocking link-local metadata; IMDSv2 hop limit of 1 when nodeup runs inside a container; transient IMDS throttling during mass rolling updates; non-EC2 environment misdetected as AWS.","solutions":["Ensure instance metadata service is reachable: curl -s -H 'X-aws-ec2-metadata-token: ...' http://169.254.169.254/latest/meta-data/local-ipv4 from the node","Raise IMDSv2 hop limit: `aws ec2 modify-instance-metadata-options --instance-id <id> --http-put-response-hop-limit 2`","Check iptables/host firewall and security setup for rules dropping 169.254.169.254 traffic","Retry nodeup — transient IMDS failures during rolling updates often resolve; check EC2 service health/region status"],"exampleFix":null,"handlingStrategy":"retry","validationCode":"// precheck: token + local-ipv4 fetch before nodeup\nTOKEN=$(curl -sX PUT --max-time 2 'http://169.254.169.254/latest/api/token' -H 'X-aws-ec2-metadata-token-ttl-seconds: 60')\ncurl -s --max-time 2 -H \"X-aws-ec2-metadata-token: $TOKEN\" http://169.254.169.254/latest/meta-data/local-ipv4 || echo \"IMDS local-ipv4 unreachable\"","typeGuard":null,"tryCatchPattern":"ip, err := c.GetMetadataLocalIP(ctx)\nif err != nil {\n    if strings.Contains(err.Error(), \"local-ipv4\") {\n        // transient IMDS failure: nodeup retries internally; on persistent failure raise hop limit / check firewall\n        return fmt.Errorf(\"IMDS local-ipv4 unavailable, verify metadata options and 169.254.169.254 egress: %w\", err)\n    }\n    return err\n}","preventionTips":["Set IMDSv2 hop limit to 2+ (required when nodeup runs in containers)","Do not block 169.254.169.254 with host firewall or network policy","Retry nodeup on transient IMDS failures during rolling updates","Verify metadata works (curl) as a node bootstrap preflight"],"tags":["aws","metadata","imds","network","nodeup"],"backgroundTag":"cloud-metadata-unavailable","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T07:17:12.445Z"}