kubernetes/kops · error

fetching metadata token: %w

Error message

fetching metadata token: %w

What it means

getLinodeMetadataValue wraps the client.Do error from the PUT /v1/token request to the Linode metadata service. It fires when the metadata endpoint is unreachable, DNS fails, the context is cancelled, or a proxy blocks the connection — meaning no metadata token can be issued.

Source

Thrown at upup/pkg/fi/cloudup/linode/linodemetadata/authenticator.go:84

// GetMetadataValue fetches the given field from the Akamai (Linode) instance metadata service
// using the standard metadata endpoint and default HTTP client.
func GetMetadataValue(ctx context.Context, key string) (string, error) {
	return getLinodeMetadataValue(ctx, http.DefaultClient, linodeMetadataBaseURL, key)
}

// getLinodeMetadataValue queries the Akamai (Linode) metadata service for the given key
// and returns the value as a string.
func getLinodeMetadataValue(ctx context.Context, client *http.Client, metadataBaseURL, key string) (string, error) {
	tokenReq, err := http.NewRequestWithContext(ctx, http.MethodPut, metadataBaseURL+"/v1/token", nil)
	if err != nil {
		return "", fmt.Errorf("building metadata token request: %w", err)
	}
	tokenReq.Header.Set("Metadata-Token-Expiry-Seconds", linodeMetadataTokenTTL)

	tokenResp, err := client.Do(tokenReq)
	if err != nil {
		return "", fmt.Errorf("fetching metadata token: %w", err)
	}
	defer tokenResp.Body.Close()

	if tokenResp.StatusCode != http.StatusOK {
		return "", fmt.Errorf("fetching metadata token: unexpected status code %d", tokenResp.StatusCode)
	}

	tokenBytes, err := io.ReadAll(tokenResp.Body)
	if err != nil {
		return "", fmt.Errorf("reading metadata token response: %w", err)
	}

	token := strings.TrimSpace(string(tokenBytes))
	if token == "" {
		return "", fmt.Errorf("metadata token was empty")
	}

	instanceReq, err := http.NewRequestWithContext(ctx, http.MethodGet, metadataBaseURL+"/v1/instance", nil)

View on GitHub (pinned to 4c8573c808)

Solutions

1. Check network reachability of the Linode metadata service from the node
2. Confirm the instance has the metadata service enabled
3. Increase or verify the context timeout for the metadata call
4. Inspect DNS and proxy settings on the node

When it happens

Trigger: Thrown at upup/pkg/fi/cloudup/linode/linodemetadata/authenticator.go:84 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/166ac2ce7b90cdc7. Report an issue: GitHub.