kubernetes/kops · error

error loading AWS config: %v

Error message

error loading AWS config: %v

What it means

When the cluster's cloud provider is AWS, KubeletBuilder.Build loads the AWS SDK default config (awsconfig.LoadDefaultConfig) to query EC2 instance identity metadata and construct the node providerID. Failure to load the AWS config chain is wrapped with this message.

Source

Thrown at nodeup/pkg/model/kubelet.go:121

func (b *KubeletBuilder) Build(c *fi.NodeupModelBuilderContext) error {
	err := b.buildKubeletServingCertificate(c)
	if err != nil {
		return fmt.Errorf("error building kubelet server cert: %v", err)
	}

	ctx := c.Context()
	kubeletConfig, err := b.buildKubeletConfigSpec(ctx)
	if err != nil {
		return fmt.Errorf("error building kubelet config: %v", err)
	}

	{
		// Set the provider ID to help speed node registration on large clusters
		var providerID string
		if b.CloudProvider() == kops.CloudProviderAWS {
			config, err := awsconfig.LoadDefaultConfig(ctx)
			if err != nil {
				return fmt.Errorf("error loading AWS config: %v", err)
			}
			metadata := imds.NewFromConfig(config)
			instanceIdentity, err := metadata.GetInstanceIdentityDocument(ctx, &imds.GetInstanceIdentityDocumentInput{})
			if err != nil {
				return err
			}
			providerID = fmt.Sprintf("aws:///%s/%s", instanceIdentity.AvailabilityZone, instanceIdentity.InstanceID)
		} else if b.CloudProvider() == kops.CloudProviderAzure {
			metadata, err := azuremetadata.QueryComputeInstanceMetadata(ctx)
			if err != nil {
				return fmt.Errorf("error querying Azure instance metadata: %v", err)
			}
			providerID = "azure://" + metadata.ResourceID
		} else if b.CloudProvider() == kops.CloudProviderDO {
			// The DO CCM resolves nodes by provider ID; its name-based fallback does not match
			// our IP-based node names.
			dropletID, err := dometadata.GetDropletID()
			if err != nil {

View on GitHub (pinned to 4c8573c808)

Solutions

1. Ensure IMDSv2 is reachable (hop limit >= 2 for containerized nodeup, metadata options enabled).
2. Check AWS_* environment variables and ~/.aws config files on the node for invalid values.
3. Verify the instance has an instance profile / can reach the EC2 metadata service (169.254.169.254).
4. Read the wrapped inner error to identify which config source failed.

Example fix

// before (IMDS hop limit 1 blocks nodeup in container)
HttpTokens: required, HttpPutResponseHopLimit: 1
// after
HttpTokens: required, HttpPutResponseHopLimit: 2

// on the node, before nodeup: confirm IMDS reachable
token=$(curl -sf -X PUT -m 2 http://169.254.169.254/latest/api/token -H 'X-aws-ec2-metadata-token-ttl-seconds: 60') || echo "IMDS unreachable"

var cfgErr *aws.Config
err := runNodeup(ctx)
if err != nil && strings.Contains(err.Error(), "error loading AWS config") {
    // check IMDS hop limit / AWS env vars, then retry
    return fmt.Errorf("aws metadata unavailable: %w", err)
}

When it happens

Trigger: awsconfig.LoadDefaultConfig fails on an AWS node — no credentials/config resolution at all and IMDS unavailable, so the SDK config cannot be constructed.

Common situations: IMDS hop limit too low / IMDS disabled on the instance, missing or corrupt shared config files with parse errors, or badly set AWS_* environment variables on the node.

Related errors

• failed to load AWS config: %w
• failed to get local-ipv4 address from ec2 metadata: %w
• error querying Azure instance metadata: %v
• error querying DigitalOcean droplet ID: %w
• error reading instance-id from AWS metadata: %v

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/eb2020e9d8e301f0. Report an issue: GitHub.