kubernetes/kops · error

error mounting configdrive '%s': %v

Error message

error mounting configdrive '%s': %v

What it means

After blkid locates the config-drive device, getFromConfigDrive (upup/pkg/fi/cloudup/openstack/openstackmetadata/metadata.go:121) tries to mount it read-only as iso9660, then as vfat. If both mount attempts fail, the device path and error are wrapped in this message.

Source

Thrown at upup/pkg/fi/cloudup/openstack/openstackmetadata/metadata.go:121

	dev := path.Join(DiskByLabelPath, ConfigDriveLabel)
	if _, err := os.Stat(dev); os.IsNotExist(err) {
		out, err := mds.mounter.Exec.Command(
			"blkid", "-l",
			"-t", fmt.Sprintf("LABEL=%s", ConfigDriveLabel),
			"-o", "device",
		).CombinedOutput()
		if err != nil {
			return nil, fmt.Errorf("unable to run blkid: %v", err)
		}
		dev = strings.TrimSpace(string(out))
	}

	err := mds.mounter.Mount(dev, mds.mountTarget, "iso9660", []string{"ro"})
	if err != nil {
		err = mds.mounter.Mount(dev, mds.mountTarget, "vfat", []string{"ro"})
	}
	if err != nil {
		return nil, fmt.Errorf("error mounting configdrive '%s': %v", dev, err)
	}
	defer mds.mounter.Unmount(mds.mountTarget)

	f, err := os.Open(
		path.Join(mds.mountTarget, mds.configDrivePath))
	if err != nil {
		return nil, fmt.Errorf("error reading '%s' on config drive: %v", mds.configDrivePath, err)
	}
	defer f.Close()

	return mds.parseMetadata(f)
}

// getFromMetadataService tries to get metadata from a metadata service endpoint and returns it as InstanceMetadata.
// If the service endpoint cannot be contacted or reports a different status than StatusOK it will return an error.
func (mds MetadataService) getFromMetadataService() (*InstanceMetadata, error) {
	var client http.Client

View on GitHub (pinned to 4c8573c808)

Solutions

1. Ensure the process runs with mount privileges (root / CAP_SYS_ADMIN, privileged container).
2. Verify kernel support: `modprobe iso9660` and `modprobe vfat` on the instance.
3. Create the mount target directory before the metadata lookup runs.
4. Confirm the device found by blkid is a valid config-drive image (`file <dev>` / `blkid <dev>`).

Example fix

// before
err := mds.mounter.Mount(dev, mds.mountTarget, "iso9660", []string{"ro"})
// after — ensure the mount point exists first
if err := os.MkdirAll(mds.mountTarget, 0755); err != nil {
    return nil, fmt.Errorf("unable to create mount target: %v", err)
}
err := mds.mounter.Mount(dev, mds.mountTarget, "iso9660", []string{"ro"})

// Ensure mount privileges and kernel support before attempting config-drive mount
if err := exec.Command("mount", "--bind", "/", "/").Run(); err != nil {
    return errors.New("process lacks mount privileges (need root/CAP_SYS_ADMIN)")
}
if err := os.MkdirAll("/mnt/config-drive", 0755); err != nil {
    return fmt.Errorf("cannot create mount target: %v", err)
}

meta, err := mds.getFromConfigDrive()
if err != nil {
    if strings.Contains(err.Error(), "error mounting configdrive") {
        // both iso9660 and vfat failed — try the metadata service instead
        return mds.getFromMetadataService()
    }
    return nil, err
}

When it happens

Trigger: mds.mounter.Mount(dev, mountTarget, "iso9660", ro) and the vfat retry both fail — the kernel lacks the filesystem modules, the mount target directory does not exist, the process lacks mount privileges, or dev is empty/garbage from a failed blkid probe.

Common situations: Containerized environments without --privileged or CAP_SYS_ADMIN; missing iso9660/vfat kernel modules on minimal hosts; /mount-target not created before mounting; config drive attached as a non-iso9660/vfat format.

Related errors

• unable to run blkid: %v
• error reading '%s' on config drive: %v
• error getting cloud instance group %q: %v
• unable to fetch metadata: %w
• %s is not a valid metadata search order option. Supported op

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/974c777e33bfba87. Report an issue: GitHub.