kubernetes/kops · error

fetching metadata token: unexpected status code %d

Error message

fetching metadata token: unexpected status code %d

What it means

getLinodeMetadataValue rejects the token-issuance response because the PUT /v1/token call returned a non-200 status. It fires when the Linode metadata service refuses to mint a token (rate limiting, metadata disabled, service error), so the caller cannot proceed to read instance metadata.

Source

Thrown at upup/pkg/fi/cloudup/linode/linodemetadata/authenticator.go:89

}

// getLinodeMetadataValue queries the Akamai (Linode) metadata service for the given key
// and returns the value as a string.
func getLinodeMetadataValue(ctx context.Context, client *http.Client, metadataBaseURL, key string) (string, error) {
	tokenReq, err := http.NewRequestWithContext(ctx, http.MethodPut, metadataBaseURL+"/v1/token", nil)
	if err != nil {
		return "", fmt.Errorf("building metadata token request: %w", err)
	}
	tokenReq.Header.Set("Metadata-Token-Expiry-Seconds", linodeMetadataTokenTTL)

	tokenResp, err := client.Do(tokenReq)
	if err != nil {
		return "", fmt.Errorf("fetching metadata token: %w", err)
	}
	defer tokenResp.Body.Close()

	if tokenResp.StatusCode != http.StatusOK {
		return "", fmt.Errorf("fetching metadata token: unexpected status code %d", tokenResp.StatusCode)
	}

	tokenBytes, err := io.ReadAll(tokenResp.Body)
	if err != nil {
		return "", fmt.Errorf("reading metadata token response: %w", err)
	}

	token := strings.TrimSpace(string(tokenBytes))
	if token == "" {
		return "", fmt.Errorf("metadata token was empty")
	}

	instanceReq, err := http.NewRequestWithContext(ctx, http.MethodGet, metadataBaseURL+"/v1/instance", nil)
	if err != nil {
		return "", fmt.Errorf("building instance metadata request: %w", err)
	}
	instanceReq.Header.Set("Metadata-Token", token)

View on GitHub (pinned to 4c8573c808)

Solutions

1. Check the reported status code: 403/404 usually means the metadata service is disabled for the instance
2. Retry after backoff on 429/5xx responses
3. Verify the Metadata-Token-Expiry-Seconds header value is acceptable to the service

When it happens

Trigger: Thrown at upup/pkg/fi/cloudup/linode/linodemetadata/authenticator.go:89 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/b384c6b296e35baa. Report an issue: GitHub.