{"record":{"id":"04285bbff366ff09","repo":"k3s-io/k3s","slug":"failed-to-read-http-config-s-w","errorCode":null,"errorMessage":"failed to read http config %s: %w","messagePattern":"failed to read http config (.+?): %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/configfilearg/parser.go","lineNumber":343,"sourceCode":"\t\tif str == \"\" {\n\t\t\treturn nil\n\t\t}\n\t\treturn []any{str}\n\t}\n}\n\n// readConfigFileData returns the contents of a local or remote file\nfunc readConfigFileData(file string) ([]byte, error) {\n\tu, err := url.Parse(file)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"failed to parse config location %s: %w\", file, err)\n\t}\n\n\tswitch u.Scheme {\n\tcase \"http\", \"https\":\n\t\tresp, err := http.Get(file)\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"failed to read http config %s: %w\", file, err)\n\t\t}\n\t\tdefer resp.Body.Close()\n\t\treturn io.ReadAll(resp.Body)\n\tdefault:\n\t\treturn os.ReadFile(file)\n\t}\n}\n","sourceCodeStart":325,"sourceCodeEnd":351,"githubUrl":"https://github.com/k3s-io/k3s/blob/6ba341e396edc16b8dcae978a7c5e3ac7ee5606e/pkg/configfilearg/parser.go#L325-L351","documentation":"When --config points at an http:// or https:// URL, readConfigFileData fetches it with a plain http.Get. This error wraps any transport-level failure: DNS resolution, connection refused, TLS handshake error, or timeout. Note the code does not check the HTTP status code, so a 404 page is read as config content and fails later at YAML parsing.","triggerScenarios":"`k3s server --config https://host/k3s.yaml` where the host is unreachable, DNS fails, the TLS certificate is untrusted (no insecure-skip-verify here), or a proxy/firewall blocks the request (pkg/configfilearg/parser.go:341-344).","commonSituations":"Config server down in air-gapped or PXE-booted environments; self-signed certificate not in the host trust store; typo in the URL; egress firewall blocking the port.","solutions":["From the same node, verify the URL: `curl -fsSL https://host/k3s.yaml` and fix whatever it reports (DNS, firewall, TLS).","For self-signed certs, install the CA into the host trust store; this code path has no skip-verify option.","If the endpoint is unreliable, download the file locally and pass a local path: `curl -o /etc/rancher/k3s/config.yaml ... && k3s server --config /etc/rancher/k3s/config.yaml`."],"exampleFix":"# before\nExecStart=/usr/local/bin/k3s server --config https://cfg.internal:8443/k3s.yaml\n\n# after (bootstrap copies it locally, immune to config-server outages)\nExecStartPre=/usr/bin/curl -fsSL https://cfg.internal:8443/k3s.yaml -o /etc/rancher/k3s/config.yaml\nExecStart=/usr/local/bin/k3s server --config /etc/rancher/k3s/config.yaml","handlingStrategy":"retry","validationCode":"// Pre-flight: URL must be reachable AND return 2xx (k3s itself ignores status codes):\nresp, err := http.Get(cfgURL)\nif err != nil || resp.StatusCode < 200 || resp.StatusCode > 299 {\n    log.Fatalf(\"config URL precheck failed: err=%v status=%v\", err, resp.StatusCode)\n}\nresp.Body.Close()","typeGuard":null,"tryCatchPattern":"// When fetching the config yourself, retry transient errors, fail fast on permanent ones:\nvar body []byte\nerr := retry(5, time.Second*2, func() error {\n    resp, err := http.Get(cfgURL)\n    if err != nil {\n        var dnsErr *net.DNSError\n        if errors.As(err, &dnsErr) { return err } // retryable\n        return err\n    }\n    defer resp.Body.Close()\n    if resp.StatusCode != 200 { return fmt.Errorf(\"status %d\", resp.StatusCode) }\n    body, err = io.ReadAll(resp.Body)\n    return err\n})","preventionTips":["Serve config over http(s) from a highly available endpoint, or cache it locally with ExecStartPre.","Monitor the config server and alert before node reboots depend on it.","Ensure CA certificates for HTTPS config endpoints are installed in the host trust store."],"tags":["network","http","tls","config","proxy"],"backgroundTag":null,"analyzedSha":"6ba341e396edc16b8dcae978a7c5e3ac7ee5606e","analyzedAt":"2026-08-15T16:27:54.286Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}