kubernetes/kops · error

failed to get info for Akamai (Linode) instance %q: empty re

Error message

failed to get info for Akamai (Linode) instance %q: empty response

What it means

VerifyToken also guards against GetInstance succeeding while returning a nil instance pointer. The linodego SDK can theoretically return (nil, nil); treating that as valid data would nil-dereference later, so the verifier returns an explicit 'empty response' error naming the instance ID. This is a defensive nil-check rather than an API-reported failure.

Source

Thrown at upup/pkg/fi/cloudup/linode/verifier.go:80

// VerifyToken verifies that the given token corresponds to a valid Akamai (Linode) instance.
func (v *linodeVerifier) VerifyToken(ctx context.Context, rawRequest *http.Request, token string, body []byte) (*bootstrap.VerifyResult, error) {
	if !strings.HasPrefix(token, linodemetadata.LinodeAuthenticationTokenPrefix) {
		return nil, bootstrap.ErrNotThisVerifier
	}

	instanceIDString := strings.TrimPrefix(token, linodemetadata.LinodeAuthenticationTokenPrefix)
	instanceID, err := strconv.Atoi(instanceIDString)
	if err != nil {
		return nil, fmt.Errorf("invalid authorization token")
	}

	instance, err := v.client.GetInstance(ctx, instanceID)
	if err != nil {
		return nil, fmt.Errorf("failed to get info for Akamai (Linode) instance %q: %w", instanceIDString, err)
	}
	if instance == nil {
		return nil, fmt.Errorf("failed to get info for Akamai (Linode) instance %q: empty response", instanceIDString)
	}

	addresses, challengeEndpoints := gatherIPv4Addresses(instance.IPv4)
	if len(challengeEndpoints) == 0 {
		return nil, fmt.Errorf("cannot determine challenge endpoint for instance id: %s", instanceIDString)
	}

	result := &bootstrap.VerifyResult{
		NodeName:          instance.Label,
		InstanceGroupName: instanceGroupNameFromTags(instance.Tags),
		CertificateNames:  addresses,
		ChallengeEndpoint: challengeEndpoints[0],
	}

	return result, nil
}

// gatherIPv4Addresses returns a list of IPv4 addresses and challenge endpoints from the given list of IPs.

View on GitHub (pinned to 4c8573c808)

Solutions

1. Inspect the SDK version's GetInstance contract; upgrade linodego if nil-nil returns are a known bug
2. In tests using fake clients, always return a populated *linodego.Instance or a real error
3. Log the instance ID and retry the lookup once before failing the verification

inst, err := client.GetInstance(ctx, id)
if err != nil || inst == nil { return errors.New("instance lookup returned no data") }

func instanceFound(inst *linodego.Instance) bool { return inst != nil }

inst, err := client.GetInstance(ctx, id)
if err != nil { return err }
if inst == nil { return fmt.Errorf("instance %d: empty response", id) }

When it happens

Trigger: v.client.GetInstance returns err == nil and instance == nil — an SDK/edge-condition response (e.g. mocked client in tests, or unexpected SDK behavior on a deleted-but-cached instance).

Common situations: Custom or fake linodego client implementations in tests returning (nil, nil); SDK versions with inconsistent nil handling; rarely in production because the real API returns an error rather than a nil body for missing instances.

Related errors

• failed to create Linode client: %w
• error hashing manifest: %v
• error hashing manifest location: %v
• error encoding version spec: %v
• error building linode node identifier: %w

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/f39d9cec1f586eda. Report an issue: GitHub.