kubernetes/kops · error

querying IMDS %s: status %d

Error message

querying IMDS %s: status %d

What it means

queryIMDS got an HTTP response from IMDS but the status code was not 200; it returns "querying IMDS <path>: status <code>". Common codes are 400 (bad/mismatched api-version or params), 404 (unknown path/version), 429 (throttled), and 5xx (IMDS internal issues). The library surfaces the numeric status so callers can distinguish these cases.

Source

Thrown at upup/pkg/fi/cloudup/azure/azuremetadata/imds.go:85

	req, err := http.NewRequestWithContext(ctx, "GET", imdsBaseURL+path, nil)
	if err != nil {
		return fmt.Errorf("creating IMDS request: %w", err)
	}
	req.Header.Add("Metadata", "True")

	params.Set("api-version", imdsAPIVersion)
	req.URL.RawQuery = params.Encode()

	klog.V(4).Infof("Azure IMDS query: %q", req.URL.String())

	resp, err := imdsHTTPClient.Do(req)
	if err != nil {
		return fmt.Errorf("querying IMDS %s: %w", path, err)
	}
	defer resp.Body.Close()

	if resp.StatusCode != http.StatusOK {
		return fmt.Errorf("querying IMDS %s: status %d", path, resp.StatusCode)
	}

	body, err := io.ReadAll(resp.Body)
	if err != nil {
		return fmt.Errorf("reading IMDS response: %w", err)
	}
	klog.V(4).Infof("Azure IMDS response: %d bytes", len(body))

	if err := json.Unmarshal(body, result); err != nil {
		return fmt.Errorf("unmarshalling IMDS response: %w", err)
	}

	return nil
}

// QueryComputeInstanceMetadata queries Azure IMDS for compute instance metadata.
// https://learn.microsoft.com/en-us/azure/virtual-machines/instance-metadata-service#instance-metadata
func QueryComputeInstanceMetadata(ctx context.Context) (*InstanceMetadata, error) {

View on GitHub (pinned to 4c8573c808)

Solutions

1. Read the numeric status in the message: retry with backoff on 429/503, fix api-version on 400/404
2. Verify the pinned imdsAPIVersion (2025-04-07) is supported; upgrade kOps if Azure deprecated it
3. Check request shape: format=json for instance metadata, valid nonce for attested document
4. If throttled, reduce parallel IMDS calls during node boot

// Inspect the status carried in the wrapped error message
func imdsStatus(err error) (int, bool) {
    m := imdsStatusRe.FindStringSubmatch(err.Error())
    if m == nil { return 0, false }
    n, _ := strconv.Atoi(m[1])
    return n, true
}
var imdsStatusRe = regexp.MustCompile(`status (\d+)`)

// Retry only throttling/server errors, fail fast on 4xx client errors
if code, ok := imdsStatus(err); ok {
    switch {
    case code == 429 || code >= 500:
        retryWithBackoff()
    default: // 400/404: api-version or request problem
        return fmt.Errorf("IMDS rejected request (status %d); check api-version", code)
    }
}

When it happens

Trigger: queryIMDS receives resp.StatusCode != 200 from either /metadata/instance/compute (with format=json) or /metadata/attested/document (with nonce param), both pinned to api-version 2025-04-07.

Common situations: IMDS throttling (429) during large scale-up bursts; deprecated api-version returning 400/404; malformed nonce causing 400 on the attested endpoint; transient 503 from IMDS.

Related errors

• empty subscription ID
• fetching intermediate certificate from %s: status %d
• querying instance metadata: %w
• missing resource ID
• querying attested document: %w

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/59723b952d3fb7c9. Report an issue: GitHub.