kubernetes/kops · error

error mounting configdrive

Error message

error mounting configdrive '%s': %v

What it means

After blkid locates the config-drive device, getFromConfigDrive (upup/pkg/fi/cloudup/openstack/openstackmetadata/metadata.go:121) tries to mount it read-only as iso9660, then as vfat. If both mount attempts fail, the device path and error are wrapped in this message.

Solutions

1. Ensure the process runs with mount privileges (root / CAP_SYS_ADMIN, privileged container).
2. Verify kernel support: `modprobe iso9660` and `modprobe vfat` on the instance.
3. Create the mount target directory before the metadata lookup runs.
4. Confirm the device found by blkid is a valid config-drive image (`file <dev>` / `blkid <dev>`).

Example fix

// before
err := mds.mounter.Mount(dev, mds.mountTarget, "iso9660", []string{"ro"})
// after — ensure the mount point exists first
if err := os.MkdirAll(mds.mountTarget, 0755); err != nil {
    return nil, fmt.Errorf("unable to create mount target: %v", err)
}
err := mds.mounter.Mount(dev, mds.mountTarget, "iso9660", []string{"ro"})

// Ensure mount privileges and kernel support before attempting config-drive mount
if err := exec.Command("mount", "--bind", "/", "/").Run(); err != nil {
    return errors.New("process lacks mount privileges (need root/CAP_SYS_ADMIN)")
}
if err := os.MkdirAll("/mnt/config-drive", 0755); err != nil {
    return fmt.Errorf("cannot create mount target: %v", err)
}

meta, err := mds.getFromConfigDrive()
if err != nil {
    if strings.Contains(err.Error(), "error mounting configdrive") {
        // both iso9660 and vfat failed — try the metadata service instead
        return mds.getFromMetadataService()
    }
    return nil, err
}

When it happens

Trigger: mds.mounter.Mount(dev, mountTarget, "iso9660", ro) and the vfat retry both fail — the kernel lacks the filesystem modules, the mount target directory does not exist, the process lacks mount privileges, or dev is empty/garbage from a failed blkid probe.

Common situations: Containerized environments without --privileged or CAP_SYS_ADMIN; missing iso9660/vfat kernel modules on minimal hosts; /mount-target not created before mounting; config drive attached as a non-iso9660/vfat format.

Related errors

• error reading ' ' on config drive
• unable to run blkid
• error getting cloud instance group
• error parsing etcd cluster tag
• failed to get info for server

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/974c777e33bfba87. Report an issue: GitHub.

Appendix: source

Thrown at upup/pkg/fi/cloudup/openstack/openstackmetadata/metadata.go:121

	dev := path.Join(DiskByLabelPath, ConfigDriveLabel)
	if _, err := os.Stat(dev); os.IsNotExist(err) {
		out, err := mds.mounter.Exec.Command(
			"blkid", "-l",
			"-t", fmt.Sprintf("LABEL=%s", ConfigDriveLabel),
			"-o", "device",
		).CombinedOutput()
		if err != nil {
			return nil, fmt.Errorf("unable to run blkid: %v", err)
		}
		dev = strings.TrimSpace(string(out))
	}

	err := mds.mounter.Mount(dev, mds.mountTarget, "iso9660", []string{"ro"})
	if err != nil {
		err = mds.mounter.Mount(dev, mds.mountTarget, "vfat", []string{"ro"})
	}
	if err != nil {
		return nil, fmt.Errorf("error mounting configdrive '%s': %v", dev, err)
	}
	defer mds.mounter.Unmount(mds.mountTarget)

	f, err := os.Open(
		path.Join(mds.mountTarget, mds.configDrivePath))
	if err != nil {
		return nil, fmt.Errorf("error reading '%s' on config drive: %v", mds.configDrivePath, err)
	}
	defer f.Close()

	return mds.parseMetadata(f)
}

// getFromMetadataService tries to get metadata from a metadata service endpoint and returns it as InstanceMetadata.
// If the service endpoint cannot be contacted or reports a different status than StatusOK it will return an error.
func (mds MetadataService) getFromMetadataService() (*InstanceMetadata, error) {
	var client http.Client

View on GitHub (pinned to 4c8573c808)