{"record":{"id":"1b8f2d294589470d","repo":"kubernetes/kops","slug":"error-building-kubernetes-client-w","errorCode":null,"errorMessage":"error building kubernetes client: %w","messagePattern":"error building kubernetes client: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"upup/pkg/fi/cloudup/openstack/verifier.go","lineNumber":91,"sourceCode":"\t// node-controller should be able to renew it tokens against OpenStack API\n\tenv.AllowReauth = true\n\n\terr = gos.Authenticate(context.TODO(), provider, env)\n\tif err != nil {\n\t\treturn nil, err\n\t}\n\n\tnovaClient, err := gos.NewComputeV2(provider, gophercloud.EndpointOpts{\n\t\tType:   \"compute\",\n\t\tRegion: region,\n\t})\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"error building nova client: %v\", err)\n\t}\n\n\tkubeClient, err := newClientSet()\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"error building kubernetes client: %w\", err)\n\t}\n\n\treturn &openstackVerifier{\n\t\tnovaClient: novaClient,\n\t\tkubeClient: kubeClient,\n\t}, nil\n}\n\nfunc stringInSlice(a string, list []string) bool {\n\tfor _, b := range list {\n\t\tif b == a {\n\t\t\treturn true\n\t\t}\n\t}\n\treturn false\n}\n\nfunc newClientSet() (*kubernetes.Clientset, error) {","sourceCodeStart":73,"sourceCodeEnd":109,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/upup/pkg/fi/cloudup/openstack/verifier.go#L73-L109","documentation":"Thrown by NewOpenstackVerifier when newClientSet() fails to build the Kubernetes clientset. The verifier needs in-cluster credentials (service account) to reach the API server; client construction failed before any request was made.","triggerScenarios":"NewOpenstackVerifier calls newClientSet(); it fails when running outside a pod (no KUBERNETES_SERVICE_HOST/PORT), with a missing/unreadable service account token at /var/run/secrets/kubernetes.io/serviceaccount, or an invalid kubeconfig.","commonSituations":"Running the verifier binary locally on an admin machine instead of inside the cluster; automountServiceAccountToken disabled on the pod; missing mounted token secret; stale or unreadable kubeconfig.","solutions":["Run the verifier inside the cluster (as a pod) so in-cluster config is available.","If running externally, provide a valid kubeconfig/KUBECONFIG and adapt newClientSet to fall back to clientcmd.","Ensure the pod has automountServiceAccountToken: true and the serviceaccount token secret exists.","Verify KUBERNETES_SERVICE_HOST/PORT env vars are set inside the container."],"exampleFix":"// before\nkubeClient, err := newClientSet() // fails outside cluster\n// after\nfunc newClientSet() (*kubernetes.Clientset, error) {\n    cfg, err := rest.InClusterConfig()\n    if err != nil {\n        cfg, err = clientcmd.NewNonInteractiveDeferredLoadingClientConfig(\n            clientcmd.NewDefaultClientConfigLoadingRules(), &clientcmd.ConfigOverrides{}).ClientConfig()\n        if err != nil {\n            return nil, err\n        }\n    }\n    return kubernetes.NewForConfig(cfg)\n}","handlingStrategy":"fallback","validationCode":"if os.Getenv(\"KUBERNETES_SERVICE_HOST\") == \"\" && os.Getenv(\"KUBECONFIG\") == \"\" {\n    if _, err := os.Stat(clientcmd.RecommendedHomeFile); err != nil {\n        return errors.New(\"no in-cluster config and no kubeconfig available\")\n    }\n}","typeGuard":null,"tryCatchPattern":"kubeClient, err := newClientSet()\nif err != nil {\n    return nil, fmt.Errorf(\"error building kubernetes client: %w\", err)\n}","preventionTips":["Run the verifier in-pod with a service account mounted","Set KUBECONFIG when running from a workstation","Keep automountServiceAccountToken enabled on the verifier pod"],"tags":["kubernetes","client-go","authentication","in-cluster-config"],"backgroundTag":"kubeconfig-not-found","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T07:17:12.445Z"}