kubernetes/kops · error

failed to get %q from ec2 meta-data: %v

Error message

failed to get %q from ec2 meta-data: %v

What it means

When the IMDS GetMetadata call fails with an error that is not a 404 ResponseError, the task wraps it with 'failed to get %q from ec2 meta-data'. This covers connectivity failures, timeouts, auth/hop-limit errors and 5xx responses from the metadata service.

Source

Thrown at upup/pkg/fi/nodeup/nodetasks/prefix.go:134

		return "", fmt.Errorf("failed to get %q from ec2 meta-data: not found", category)
	}

	return values[0], nil
}

func getInstanceMetadataList(ctx context.Context, category string) ([]string, error) {
	cfg, err := awsconfig.LoadDefaultConfig(ctx)
	if err != nil {
		return nil, fmt.Errorf("failed to load aws config: %v", err)
	}
	metadata := imds.NewFromConfig(cfg)
	resp, err := metadata.GetMetadata(ctx, &imds.GetMetadataInput{Path: category})
	if err != nil {
		var awsErr *smithyhttp.ResponseError
		if errors.As(err, &awsErr) && awsErr.HTTPStatusCode() == http.StatusNotFound {
			return nil, nil
		} else {
			return nil, fmt.Errorf("failed to get %q from ec2 meta-data: %v", category, err)
		}
	}
	defer resp.Content.Close()
	lines, err := io.ReadAll(resp.Content)
	if err != nil {
		return nil, fmt.Errorf("failed to read %q from ec2 meta-data: %v", category, err)
	}

	var values []string
	for _, line := range strings.Split(string(lines), "\n") {
		line = strings.TrimSpace(line)
		if len(line) > 0 {
			values = append(values, line)
		}
	}

	return values, nil
}

View on GitHub (pinned to 4c8573c808)

Solutions

1. Confirm the metadata endpoint is reachable: curl http://169.254.169.254/latest/meta-data/.
2. Increase the IMDS hop limit to 2+ if nodeup runs inside a container.
3. Ensure IMDSv2 token requests succeed (no proxy interfering with PUT to the token endpoint).
4. Check security groups/host firewall allow egress to 169.254.169.254.

conn, err := net.DialTimeout("tcp", "169.254.169.254:80", 2*time.Second)
if err != nil { return errors.New("IMDS endpoint blocked") }

var respErr *smithyhttp.ResponseError
if errors.As(err, &respErr) && respErr.HTTPStatusCode() >= 500 {
    // transient: retry with backoff
}

When it happens

Trigger: IMDS unreachable (169.254.169.254 blocked by firewall/NetworkPolicy), HTTP 401/403 from IMDS token requirements (IMDSv2 hop limit), or non-404 HTTP errors.

Common situations: Containers on the host network with hop limit 1; iptables rules blocking link-local traffic; IMDSv2 enforced with token fetch failing; EC2 maintenance returning 5xx.

Related errors

• getting primary MAC address from ec2 metadata: %w
• failed to get region from ec2 metadata: %w
• cannot determine challenge endpoint for instance id: %s
• error listing EgressOnlyInternetGateways: %v
• found multiple EgressOnlyInternetGateways matching tags

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/1c2b46950789adaa. Report an issue: GitHub.