{"record":{"id":"218263977bc4204f","repo":"kubernetes/kops","slug":"creating-aws-ipam-controller-w","errorCode":null,"errorMessage":"creating aws IPAM controller: %w","messagePattern":"creating aws IPAM controller: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"cmd/kops-controller/main.go","lineNumber":406,"sourceCode":"\t\treturn err\n\t}\n\n\treturn nil\n}\n\n// Reconciler is the interface for a standard Reconciler.\ntype Reconciler interface {\n\tSetupWithManager(mgr manager.Manager) error\n}\n\nfunc setupCloudIPAM(ctx context.Context, mgr manager.Manager, opt *config.Options) error {\n\tsetupLog.Info(\"enabling IPAM controller\")\n\tvar controller Reconciler\n\tswitch opt.Cloud {\n\tcase \"aws\":\n\t\tipamController, err := controllers.NewAWSIPAMReconciler(ctx, mgr)\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"creating aws IPAM controller: %w\", err)\n\t\t}\n\t\tcontroller = ipamController\n\tcase \"gce\":\n\t\tipamController, err := controllers.NewGCEIPAMReconciler(mgr)\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"creating gce IPAM controller: %w\", err)\n\t\t}\n\t\tcontroller = ipamController\n\tcase \"metal\":\n\t\tipamController, err := controllers.NewMetalIPAMReconciler(ctx, mgr)\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"creating metal IPAM controller: %w\", err)\n\t\t}\n\t\tcontroller = ipamController\n\tdefault:\n\t\treturn fmt.Errorf(\"kOps IPAM controller is not supported on cloud %q\", opt.Cloud)\n\t}\n","sourceCodeStart":388,"sourceCodeEnd":424,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/cmd/kops-controller/main.go#L388-L424","documentation":"kops-controller failed while constructing the AWS IPAM reconciler, the controller-runtime component that allocates and attaches VPC IPAM addresses for nodes on AWS. NewAWSIPAMReconciler returned a non-nil error, and setupCloudIPAM wraps it with this message so the root cause (e.g. cloud client or config construction failure) is preserved via %w. The process exits before the manager starts any controllers.","triggerScenarios":"controllers.NewAWSIPAMReconciler(ctx, mgr) returns err; invoked only when --cloud=aws and the IPAM controller is enabled in kops-controller startup.","commonSituations":"Misconfigured AWS credentials or region when building the cloud client; failure creating the EC2/AWS SDK client; incompatible manager options passed in; regression after kops version upgrade.","solutions":["Inspect the wrapped cause (%w) in the controller log to see why NewAWSIPAMReconciler failed","Verify AWS credentials and region are available to kops-controller (env vars, IRSA, instance profile)","Confirm --cloud=aws is intended and the IPAM feature flag is correct; disable IPAM controller if not needed","Rebuild/redeploy kops-controller matching the cluster version"],"exampleFix":"// before\nipamController, err := controllers.NewAWSIPAMReconciler(ctx, mgr)\nif err != nil {\n\treturn fmt.Errorf(\"creating aws IPAM controller: %w\", err)\n}\n// after: surface and gate on cause\nipamController, err := controllers.NewAWSIPAMReconciler(ctx, mgr)\nif err != nil {\n\tsetupLog.Error(err, \"aws IPAM controller creation failed; check cloud credentials/config\")\n\treturn fmt.Errorf(\"creating aws IPAM controller: %w\", err)\n}","handlingStrategy":"validation","validationCode":"// before enabling the IPAM controller on aws\nif opt.Cloud != \"aws\" {\n\treturn fmt.Errorf(\"IPAM controller requires --cloud=aws, got %q\", opt.Cloud)\n}\n// verify AWS config is reachable\nif _, err := config.LoadDefaultConfig(ctx); err != nil {\n\treturn fmt.Errorf(\"AWS credentials unavailable: %w\", err)\n}","typeGuard":null,"tryCatchPattern":"// Go: check wrapped error at startup\nif err := setupCloudIPAM(ctx, controllers, mgr, opt); err != nil {\n\tvar fatalErr error\n\tif errors.As(err, &fatalErr) {\n\t\tsetupLog.Error(err, \"IPAM controller setup failed\")\n\t}\n\tos.Exit(1)\n}","preventionTips":["Only enable the IPAM controller on supported clouds (aws/gce/metal)","Ensure cloud credentials/region are provisioned before controller start","Test controller startup in CI with the target cloud config"],"tags":["aws","ipam","controller-runtime","startup"],"backgroundTag":"controller-init-failed","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T07:17:12.445Z"}