kubernetes/kops · error

getting instance metadata: %w

Error message

getting instance metadata: %w

What it means

newVerifierClient bootstraps Azure API clients from the local instance's IMDS compute metadata. If azuremetadata.QueryComputeInstanceMetadata returns an error or nil metadata, the verifier cannot scope itself and wraps the cause with this message.

Source

Thrown at upup/pkg/fi/cloudup/azure/verifier.go:296

	}
	return addrs, challengeEndpoints, nil
}

// client is an Azure client.
type client struct {
	subscriptionID string
	resourceGroup  string
	nisClient      *network.InterfacesClient
	vmsClient      *compute.VirtualMachinesClient
	vmssVMsClient  *compute.VirtualMachineScaleSetVMsClient
}

// newVerifierClient builds Azure API clients scoped to the local instance's subscription and
// resource group from IMDS metadata.
func newVerifierClient(ctx context.Context) (*client, error) {
	metadata, err := azuremetadata.QueryComputeInstanceMetadata(ctx)
	if err != nil || metadata == nil {
		return nil, fmt.Errorf("getting instance metadata: %w", err)
	}
	if metadata.ResourceGroupName == "" {
		return nil, fmt.Errorf("empty resource group name")
	}
	if metadata.SubscriptionID == "" {
		return nil, fmt.Errorf("empty subscription ID")
	}
	klog.V(4).Infof("Azure verifier client using subscription %q resource group %q", metadata.SubscriptionID, metadata.ResourceGroupName)

	cred, err := azidentity.NewDefaultAzureCredential(nil)
	if err != nil {
		return nil, fmt.Errorf("creating an identity: %w", err)
	}

	nisClient, err := network.NewInterfacesClient(metadata.SubscriptionID, cred, nil)
	if err != nil {
		return nil, fmt.Errorf("creating interfaces client: %w", err)
	}

View on GitHub (pinned to 4c8573c808)

Solutions

1. Verify IMDS works from the node: curl -H Metadata:true 'http://169.254.169.254/metadata/instance/compute?api-version=2021-02-01' — fix routing/firewall if not
2. If the VM just booted, retry — IMDS returns 429/503 until ready
3. Confirm the verifier only runs on Azure nodes; run kops control-plane verifier components on Azure infrastructure
4. Check the metadata API version used by azuremetadata is still supported by the region

req, _ := http.NewRequest("GET", "http://169.254.169.254/metadata/instance/compute?api-version=2021-02-01", nil)
req.Header.Set("Metadata", "true")
// if this fails or times out, IMDS is unavailable; don't attempt verification

metadata, err := azuremetadata.QueryComputeInstanceMetadata(ctx)
if err != nil || metadata == nil {
	// retry with backoff: IMDS is often not ready right after boot (429/503)
}

When it happens

Trigger: QueryComputeInstanceMetadata fails (IMDS unreachable, timeout, non-200 response, malformed JSON) or returns nil, e.g. when run off-cloud or before the NIC/IMDS route is available; note that a non-nil err with nil metadata also produces a wrapped nil-pointer detail.

Common situations: Node runs in an environment without Azure IMDS (local dev, non-Azure CI); IMDS blocked by iptables/proxy or 169.254.169.254 route missing; IMDS not yet ready seconds after VM boot (429/503 during warm-up); kOps verifier running where managed identity is absent.

Related errors

• empty subscription ID
• empty resource group name
• empty subscription ID
• failed to load AWS config: %w
• failed to get local-ipv4 address from ec2 metadata: %w

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/f3f46cb714b090b9. Report an issue: GitHub.