{"record":{"id":"0c7d5e99caa2adee","repo":"kubernetes/kops","slug":"kube-controller-manager-nodes-requires-the-experim","errorCode":null,"errorMessage":"kube-controller-manager nodes requires the ExperimentalRoles feature flag to be enabled","messagePattern":"kube-controller-manager nodes requires the ExperimentalRoles feature flag to be enabled","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"upup/pkg/fi/cloudup/new_cluster.go","lineNumber":550,"sourceCode":"\t\t} else if g.Spec.Role.HasBastion() {\n\t\t\tif g.Spec.MachineType == \"\" {\n\t\t\t\tg.Spec.MachineType, err = defaultMachineType(cloud, cluster, g)\n\t\t\t\tif err != nil {\n\t\t\t\t\treturn nil, fmt.Errorf(\"error assigning default machine type for bastions: %v\", err)\n\t\t\t\t}\n\t\t\t}\n\t\t} else {\n\t\t\tif g.IsAPIServerOnly() && !featureflag.APIServerNodes.Enabled() {\n\t\t\t\treturn nil, fmt.Errorf(\"apiserver nodes requires the APIServerNodes feature flag to be enabled\")\n\t\t\t}\n\t\t\tif !featureflag.ExperimentalRoles.Enabled() {\n\t\t\t\tswitch {\n\t\t\t\tcase g.Spec.Role.HasEtcd():\n\t\t\t\t\treturn nil, fmt.Errorf(\"etcd nodes requires the ExperimentalRoles feature flag to be enabled\")\n\t\t\t\tcase g.Spec.Role.HasScheduler():\n\t\t\t\t\treturn nil, fmt.Errorf(\"scheduler nodes requires the ExperimentalRoles feature flag to be enabled\")\n\t\t\t\tcase g.Spec.Role.HasKubeControllerManager():\n\t\t\t\t\treturn nil, fmt.Errorf(\"kube-controller-manager nodes requires the ExperimentalRoles feature flag to be enabled\")\n\t\t\t\t}\n\t\t\t}\n\t\t\tif g.Spec.MachineType == \"\" {\n\t\t\t\tg.Spec.MachineType, err = defaultMachineType(cloud, cluster, g)\n\t\t\t\tif err != nil {\n\t\t\t\t\treturn nil, fmt.Errorf(\"error assigning default machine type for nodes: %v\", err)\n\t\t\t\t}\n\t\t\t}\n\n\t\t}\n\n\t\tif ig.Spec.Tenancy != \"\" && ig.Spec.Tenancy != \"default\" {\n\t\t\tswitch cluster.GetCloudProvider() {\n\t\t\tcase api.CloudProviderAWS:\n\t\t\t\tif _, ok := awsDedicatedInstanceExceptions[g.Spec.MachineType]; ok {\n\t\t\t\t\treturn nil, fmt.Errorf(\"invalid dedicated instance type: %s\", g.Spec.MachineType)\n\t\t\t\t}\n\t\t\tdefault:","sourceCodeStart":532,"sourceCodeEnd":568,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/upup/pkg/fi/cloudup/new_cluster.go#L532-L568","documentation":"NewCluster validation guard: fires when an instance group has a kube-controller-manager-only role (nodes running only KCM) but the ExperimentalRoles feature flag is not enabled. Creating such instance groups is unsupported without the flag, so cluster creation is aborted.","triggerScenarios":"`kops create cluster` (or adding an IG) where a group's role has the kube-controller-manager component while KOPS_FEATURE_FLAGS lacks ExperimentalRoles.","commonSituations":"Highly customized cluster layouts; specs copied from experimental setups; environments where feature-flag env vars are stripped for security.","solutions":["Enable the flag: `export KOPS_FEATURE_FLAGS=ExperimentalRoles` and retry.","Change the instance group role so kube-controller-manager runs on the control plane (default topology).","Upgrade kops if the component split has since been stabilized."],"exampleFix":"// before\nkops create cluster --name=example.com   # kcm-only IG, flag unset\n// after\nexport KOPS_FEATURE_FLAGS=ExperimentalRoles\nkops create cluster --name=example.com","handlingStrategy":"validation","validationCode":"if hasRole(igGroups, \"kube-controller-manager\") && !featureFlagEnabled(\"ExperimentalRoles\") {\n    return errors.New(\"ExperimentalRoles flag required for dedicated kcm IGs\")\n}","typeGuard":null,"tryCatchPattern":"_, err := NewCluster(opt, cluster, zoneMap)\nif err != nil {\n    if strings.Contains(err.Error(), \"kube-controller-manager nodes requires\") {\n        return fmt.Errorf(\"enable ExperimentalRoles or run kcm on control plane: %w\", err)\n    }\n    return err\n}","preventionTips":["Validate IG role strings before submitting specs","Centralize feature-flag configuration","Only split control-plane components when the flag is intentionally enabled"],"tags":["feature-flag","kube-controller-manager","instance-group","kops"],"backgroundTag":"feature-flag-not-enabled","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T07:17:12.445Z"}