kubernetes/kops · error

error querying droplet metadata: %w

Error message

error querying droplet metadata: %w

What it means

getMetadata wraps http.Get failure when querying the DigitalOcean droplet metadata endpoint (http://169.254.169.254/metadata/v1/id). It fires when the metadata service is unreachable from the droplet — not running on DO, networking/firewall blocking link-local, or transient network failure — so the bootstrap authenticator cannot build the droplet-scoped token.

Source

Thrown at upup/pkg/fi/cloudup/do/dometadata/authenticator.go:61

	if err != nil {
		return "", fmt.Errorf("unable to fetch droplet id: %w", err)
	}
	return DOAuthenticationTokenPrefix + dropletID, nil
}

const (
	dropletIDMetadataURL = "http://169.254.169.254/metadata/v1/id"
)

// GetDropletID returns the droplet ID from the metadata service.
func GetDropletID() (string, error) {
	return getMetadata(dropletIDMetadataURL)
}

func getMetadata(url string) (string, error) {
	resp, err := http.Get(url)
	if err != nil {
		return "", fmt.Errorf("error querying droplet metadata: %w", err)
	}
	defer resp.Body.Close()

	if resp.StatusCode != http.StatusOK {
		return "", fmt.Errorf("droplet metadata returned non-200 status code: %d", resp.StatusCode)
	}

	bodyBytes, err := io.ReadAll(resp.Body)
	if err != nil {
		return "", fmt.Errorf("error reading droplet metadata: %w", err)
	}

	return string(bodyBytes), nil
}

View on GitHub (pinned to 4c8573c808)

Solutions

1. Check node networking/firewall access to 169.254.169.254
2. Confirm the instance is a DigitalOcean droplet
3. Retry bootstrap once the network path is healthy

When it happens

Trigger: Thrown at upup/pkg/fi/cloudup/do/dometadata/authenticator.go:61 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/b0ddce291cc91c1a. Report an issue: GitHub.