kubernetes/kops · error

failed to get info for server %q: %w

Error message

failed to get info for server %q: %w

What it means

Thrown by VerifyToken when servers.Get fails to fetch the Nova server record identified by the token (the token is the prefix plus a server ID). During instance metadata authentication the verifier must confirm the requesting server exists in Nova; any Nova API error (404, auth failure, network) surfaces wrapped here.

Source

Thrown at upup/pkg/fi/cloudup/openstack/verifier.go:132

	return kubernetes.NewForConfig(config)
}

// readKubeConfig ...
func readKubeConfig() (*restclient.Config, error) {
	return clientcmd.NewNonInteractiveDeferredLoadingClientConfig(
		clientcmd.NewDefaultClientConfigLoadingRules(),
		&clientcmd.ConfigOverrides{}).ClientConfig()
}

func (o openstackVerifier) VerifyToken(ctx context.Context, rawRequest *http.Request, token string, body []byte) (*bootstrap.VerifyResult, error) {
	if !strings.HasPrefix(token, openstackmetadata.OpenstackAuthenticationTokenPrefix) {
		return nil, bootstrap.ErrNotThisVerifier
	}
	serverID := strings.TrimPrefix(token, openstackmetadata.OpenstackAuthenticationTokenPrefix)

	instance, err := servers.Get(ctx, o.novaClient, serverID).Extract()
	if err != nil {
		return nil, fmt.Errorf("failed to get info for server %q: %w", token, err)
	}

	var addrs []string

	var addresses map[string][]Address
	err = mapstructure.Decode(instance.Addresses, &addresses)
	if err != nil {
		return nil, fmt.Errorf("unable to decode addresses: %w", err)
	}

	for _, addrList := range addresses {
		for _, props := range addrList {
			addrs = append(addrs, props.Addr)
		}
	}
	// ensure that request is coming from same machine
	requestAddr, _, err := net.SplitHostPort(rawRequest.RemoteAddr)
	if err != nil {

View on GitHub (pinned to 4c8573c808)

Solutions

1. Check the wrapped error: 404 means the server ID in the token doesn't exist in this region — verify the Nova client's region config.
2. Have the node re-fetch its metadata token and retry bootstrap verification.
3. Confirm the verifier's Nova credentials are valid (401 indicates expired tokens).
4. Ensure requests are routed to a verifier configured for the correct cluster/region.

Example fix

// before
instance, err := servers.Get(ctx, o.novaClient, serverID).Extract()
if err != nil {
    return nil, fmt.Errorf("failed to get info for server %q: %w", token, err)
}
// after
instance, err := servers.Get(ctx, o.novaClient, serverID).Extract()
if err != nil {
    if gophercloud.ResponseCodeIs(err, http.StatusNotFound) {
        return nil, bootstrap.ErrTokenNotFound
    }
    return nil, fmt.Errorf("failed to get info for server %q: %w", token, err)
}

if !strings.HasPrefix(token, openstackmetadata.OpenstackAuthenticationTokenPrefix) {
    return nil, bootstrap.ErrNotThisVerifier
}

instance, err := servers.Get(ctx, o.novaClient, serverID).Extract()
if err != nil {
    if gophercloud.ResponseCodeIs(err, http.StatusNotFound) {
        return nil, bootstrap.ErrTokenNotFound
    }
    return nil, fmt.Errorf("failed to get info for server %q: %w", token, err)
}

When it happens

Trigger: VerifyToken strips openstackmetadata.OpenstackAuthenticationTokenPrefix from the token and calls servers.Get(ctx, o.novaClient, serverID).Extract(); the call errors when the server doesn't exist (404), the verifier's Nova credentials expired, the region/client is wrong, or the network call fails.

Common situations: Node terminated/replaced between token issuance and verification; verifier's Nova client built for a different region than the node; stale token with an outdated server ID; Keystone/Nova auth expiry on the verifier's client.

Related errors

• unable to fetch metadata: %w
• error building nova client: %v
• failed to retrieve server ID: %w
• no decernable storage availability zone could be mapped to c
• error building openstack authenticated client: %v

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/9959baeb2f6fed56. Report an issue: GitHub.