kubernetes/kops · error

failed to load AWS config: %w

Error message

failed to load AWS config: %w

What it means

getMachineType calls awsconfig.LoadDefaultConfig(ctx) to build an AWS SDK v2 config so it can query IMDS for the instance type. If the SDK cannot resolve credentials/region (LoadDefaultConfig errors), nodeup wraps the failure with this message and aborts machine-type detection.

Source

Thrown at upup/pkg/fi/nodeup/command.go:412

	if err != nil {
		return fmt.Errorf("error closing target: %w", err)
	}

	if nodeupConfig.EnableLifecycleHook {
		if bootConfig.CloudProvider == api.CloudProviderAWS {
			err := completeWarmingLifecycleAction(ctx, cloud, modelContext)
			if err != nil {
				return fmt.Errorf("failed to complete lifecylce action: %w", err)
			}
		}
	}
	return nil
}

func getMachineType(ctx context.Context) (string, error) {
	config, err := awsconfig.LoadDefaultConfig(ctx)
	if err != nil {
		return "", fmt.Errorf("failed to load AWS config: %w", err)
	}

	metadata := imds.NewFromConfig(config)

	// Get the actual instance type by querying the EC2 instance metadata service.
	result, err := metadata.GetMetadata(ctx, &imds.GetMetadataInput{
		Path: "instance-type",
	})
	if err != nil {
		return "", fmt.Errorf("failed to get instance metadata type: %w", err)
	}
	defer result.Content.Close()
	instanceTypeName, err := io.ReadAll(result.Content)
	if err != nil {
		return "", fmt.Errorf("failed to read instance metadata response: %w", err)
	}
	return string(instanceTypeName), err
}

View on GitHub (pinned to 4c8573c808)

Solutions

1. Restore IMDS reachability: curl -s http://169.254.169.254/latest/api/token should return a token from the node.
2. If launched with metadata options requiring tokens, fix hop limit (>=2 for containerized nodeup) via instance metadata options.
3. Check for invalid AWS_PROFILE / ~/.aws/config on the node and remove it so defaults resolve from IMDS.
4. Run nodeup directly on the host (not in a network-isolated container) so the link-local metadata address is routable.

Example fix

// before: container with hop-limit 1 cannot fetch IMDSv2 token
// after: set instance metadata options
aws ec2 modify-instance-metadata-options --instance-id i-xxx \
  --http-tokens required --http-put-response-hop-limit 2

TOKEN=$(curl -sf -X PUT http://169.254.169.254/latest/api/token -H 'X-aws-ec2-metadata-token-ttl-seconds: 60') && curl -sf -H "X-aws-ec2-metadata-token: $TOKEN" http://169.254.169.254/latest/meta-data/instance-type

machineType, err := getMachineType(ctx)
if err != nil {
    if isTransient(err) { // IMDS network errors
        time.Sleep(retryBackoff)
        machineType, err = getMachineType(ctx)
    }
    if err != nil {
        klog.Fatalf("cannot determine machine type: %v", err)
    }
}

When it happens

Trigger: awsconfig.LoadDefaultConfig(ctx) returns an error on an AWS node — typically IMDS unreachable, EC2 instance metadata disabled, or a broken shared-config/env setup that the default config chain tries to load.

Common situations: EC2 launched with MetadataOptions HttpTokens required but IMDS hop limit/endpoint broken in a container; nodeup running where the metadata endpoint is blocked by iptables/NetworkPolicy; corrupted ~/.aws/config with an invalid profile; IMDSv2 packet limit set too low.

Related errors

• loading AWS config: %w
• failed to load AWS config: %w
• failed to get local-ipv4 address from ec2 metadata: %w
• finding primary network interface: %w
• error reading instance-id from AWS metadata: %v

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/8345751e19ad0b7e. Report an issue: GitHub.