{"record":{"id":"179fbe48347b0a8e","repo":"kubernetes/kops","slug":"failed-to-get-node-config-from-server-w","errorCode":null,"errorMessage":"failed to get node config from server: %w","messagePattern":"failed to get node config from server: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"critical","filePath":"upup/pkg/fi/nodeup/command.go","lineNumber":120,"sourceCode":"\n\tif c.CacheDir == \"\" {\n\t\treturn fmt.Errorf(\"CacheDir is required\")\n\t}\n\n\tregion, err := getRegion(ctx, &bootConfig)\n\tif err != nil {\n\t\treturn err\n\t}\n\n\tvar configBase vfs.Path\n\n\t// If we're using a config server instead of vfs, nodeConfig will hold our configuration\n\tvar nodeConfig *nodeup.NodeConfig\n\n\tif bootConfig.ConfigServer != nil && len(bootConfig.ConfigServer.Servers) > 0 {\n\t\tresponse, err := getNodeConfigFromServers(ctx, &bootConfig, region)\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"failed to get node config from server: %w\", err)\n\t\t}\n\t\tnodeConfig = response.NodeConfig\n\t} else if fi.ValueOf(bootConfig.ConfigBase) != \"\" {\n\t\tvar err error\n\t\tconfigBase, err = vfs.Context.BuildVfsPath(*bootConfig.ConfigBase)\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"cannot parse ConfigBase %q: %v\", *bootConfig.ConfigBase, err)\n\t\t}\n\t} else {\n\t\treturn fmt.Errorf(\"ConfigBase or ConfigServer is required\")\n\t}\n\n\tvar nodeupConfig nodeup.Config\n\tvar nodeupConfigHash [32]byte\n\tswitch {\n\tcase nodeConfig != nil:\n\t\tif err := utils.YamlUnmarshal([]byte(nodeConfig.NodeupConfig), &nodeupConfig); err != nil {\n\t\t\treturn fmt.Errorf(\"error parsing BootConfig config response: %v\", err)","sourceCodeStart":102,"sourceCodeEnd":138,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/upup/pkg/fi/nodeup/command.go#L102-L138","documentation":"nodeup's Run() fetches the node (bootstrap) configuration from a config server when bootConfig.ConfigServer is configured. This error wraps any failure from getNodeConfigFromServers — network failures, TLS errors, server-side 4xx/5xx responses, or malformed responses — so the node cannot proceed with provisioning.","triggerScenarios":"kops node bootstrap with ConfigServer set (bootConfig.ConfigServer.Servers non-empty) and getNodeConfigFromServers returns an error: server unreachable, wrong address, TLS handshake failure against the server CA, or the server rejects the node's request.","commonSituations":"Nodes launched before the config server is reachable (security group / load balancer not yet ready), misconfigured kops-feature-flag UseConfigServer, stale or missing CA certificates in ConfigServer.CACertificates, DNS not resolving the API server, or node lacking outbound network at boot time.","solutions":["Verify the config server address(es) in ConfigServer.Servers are correct and reachable from the node (curl from the node).","Check that ConfigServer.CACertificates matches the cert the config server presents; re-run kops update/rolling-update to refresh it.","Confirm security groups / firewall allow HTTPS from the node subnet to the config server.","Retry node boot — transient control-plane unavailability during cluster bring-up is a common cause.","If config-server mode is not intended, unset ConfigServer and provide a valid ConfigBase instead."],"exampleFix":"// before (wrong server host in NodeUpConfig)\nconfigServer:\n  servers: [\"https://api.internal.example.invalid:9000\"]\n// after\nconfigServer:\n  servers: [\"https://api.internal.example.com:9000\"]\n  caCertificates: <PEM from 'kops get cluster -o yaml'>","handlingStrategy":"retry","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":["Pre-flight reachability check of config servers before node boot","Keep CACertificates in sync with the config server certificate"],"tags":["go","nodeup","config-server","network"],"backgroundTag":"config-server-unreachable","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T07:17:12.445Z"}