kubernetes/kops · error

loading AWS config: %w

Error message

loading AWS config: %w

What it means

This error is wrapped at the single point where nodeup calls awsconfig.LoadDefaultConfig(ctx) to obtain an AWS SDK config for the EC2 IMDS client. It means the AWS SDK for Go v2 failed to build a default configuration (credential/provider chain or shared config loading), so nodeup cannot even reach the instance metadata service. Because markSecondaryENIsUnmanaged needs the primary ENI's MAC to write 75-eni-secondary.network, the whole secondary-ENI unmanaged marking is skipped when this fails.

Source

Thrown at nodeup/pkg/model/networking/eni_networking.go:191

`, primary)

	c.AddTask(&nodetasks.File{
		Path:            "/etc/systemd/network/75-eni-secondary.network",
		Contents:        fi.NewStringResource(contents),
		Type:            nodetasks.FileType_File,
		AfterPackages:   true,
		OnChangeExecute: [][]string{{"systemctl", "restart", "systemd-networkd"}},
	})
	return nil
}

// primaryInterfaceName gives the name of the primary network interface. It gets the MAC address
// of the primary ENI (device-number 0) from the IMDS item "mac". Then it compares this MAC
// address with the physical network interfaces in sysfs.
func primaryInterfaceName(ctx context.Context) (string, error) {
	config, err := awsconfig.LoadDefaultConfig(ctx)
	if err != nil {
		return "", fmt.Errorf("loading AWS config: %w", err)
	}
	metadata := imds.NewFromConfig(config)
	resp, err := metadata.GetMetadata(ctx, &imds.GetMetadataInput{Path: "mac"})
	if err != nil {
		return "", fmt.Errorf("getting primary MAC address from ec2 metadata: %w", err)
	}
	defer resp.Content.Close()
	mac, err := io.ReadAll(resp.Content)
	if err != nil {
		return "", fmt.Errorf("reading primary MAC address from ec2 metadata: %w", err)
	}

	return findPhysicalInterfaceByMAC("/sys/class/net", strings.TrimSpace(string(mac)))
}

// findPhysicalInterfaceByMAC gives the name of the physical network interface that has the
// specified MAC address. The function ignores the virtual interfaces (veths, bridges, VLANs),
// because a virtual interface can have the same MAC address as a physical interface. The

View on GitHub (pinned to 4c8573c808)

Solutions

1. Inspect nodeup logs for the underlying wrapped error (%w) to see which config step failed
2. Fix or remove invalid AWS_* environment variables (AWS_PROFILE, AWS_REGION, AWS_CONFIG_FILE) on the node
3. Validate /root/.aws/config and /root/.aws/credentials (or the image-baked equivalents) parse as valid INI
4. Rebuild the node image so no stale/broken shared AWS config is present, then recycle the instance

Example fix

// before (env leaking into node provisioning)
AWS_PROFILE=nonexistent kops-apply...
// after
unset AWS_PROFILE AWS_CONFIG_FILE; nodeup runs LoadDefaultConfig cleanly

if os.Getenv("AWS_PROFILE") != "" || os.Getenv("AWS_CONFIG_FILE") != "" {
    // log and clear before nodeup runs
    os.Unsetenv("AWS_PROFILE")
    os.Unsetenv("AWS_CONFIG_FILE")
}

primary, err := primaryInterfaceName(ctx)
if err != nil {
    return fmt.Errorf("finding primary network interface: %w", err) // skip creating the unmanaged file; leave systemd-networkd defaults
}

When it happens

Trigger: awsconfig.LoadDefaultConfig(ctx) returns an error, e.g. malformed AWS_CONFIG_FILE/AWS_SHARED_CREDENTIALS_FILE contents, an invalid AWS_REGION or AWS_PROFILE, or a failure resolving the shared config/credentials files on the node.

Common situations: Broken or hand-edited /etc/aws-config or ~/.aws/config on an AMI; a corrupted environment (AWS_PROFILE pointing at a nonexistent profile) baked into the node image; SDK shared-config parsing failures on AmazonLinux/Debian12 nodes where this builder runs.

Related errors

• failed to load AWS config: %w
• failed to load AWS config: %w
• failed to get local-ipv4 address from ec2 metadata: %w
• finding primary network interface: %w
• error reading instance-id from AWS metadata: %v

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/26bca3edc1e3cd25. Report an issue: GitHub.