{"record":{"id":"2bdf7e4447ea62b3","repo":"kubernetes/kops","slug":"cannot-build-kube-client-w","errorCode":null,"errorMessage":"cannot build kube client: %w","messagePattern":"cannot build kube client: %w","errorType":"console","errorClass":null,"httpStatus":null,"severity":"error","filePath":"cmd/kops/delete_instance.go","lineNumber":187,"sourceCode":"\t\treturn err\n\t}\n\n\tvar k8sClient kubernetes.Interface\n\tvar restConfig *rest.Config\n\tif !options.CloudOnly {\n\t\trestConfig, err = f.RESTConfig(ctx, cluster, options.CreateKubecfgOptions)\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"getting rest config: %w\", err)\n\t\t}\n\n\t\thttpClient, err := f.HTTPClient(restConfig)\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"getting http client: %w\", err)\n\t\t}\n\n\t\tk8sClient, err = kubernetes.NewForConfigAndClient(restConfig, httpClient)\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"cannot build kube client: %w\", err)\n\t\t}\n\t}\n\n\tvar nodes []v1.Node\n\tif !options.CloudOnly {\n\t\tnodes, err = getNodes(ctx, k8sClient, true)\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t}\n\n\tlist, err := clientSet.InstanceGroupsFor(cluster).List(ctx, metav1.ListOptions{})\n\tif err != nil {\n\t\treturn err\n\t}\n\n\tvar instanceGroups []*kopsapi.InstanceGroup\n\tfor i := range list.Items {","sourceCodeStart":169,"sourceCodeEnd":205,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/cmd/kops/delete_instance.go#L169-L205","documentation":"This error is returned by RunDeleteInstance in cmd/kops/delete_instance.go when client-go's kubernetes.NewForConfigAndClient fails to construct a Kubernetes clientset from the REST config and HTTP client built for the target cluster. It wraps the underlying error, which is almost always a malformed or invalid rest.Config (bad host URL, invalid TLS material) rather than a network failure — the client is only constructed, never dialed, at this point.","triggerScenarios":"Running `kops delete instance` without --cloudonly when f.RESTConfig(ctx, cluster, options.CreateKubecfgOptions) yields a config that client-go rejects: unparseable server URL, corrupt/invalid client certificate or key data, unsupported TLS configuration, or an invalid transport setting passed to f.HTTPClient.","commonSituations":"Stale or hand-edited kubeconfig entries for the cluster; a kops state-store cluster spec with a bad kubeAPI server URL; certificates rotated or expired so the embedded cert/key pair no longer parses; a corporate proxy or custom CA setting producing an invalid HTTP client; version mismatch between client-go and the generated config.","solutions":["Read the wrapped %w error to see which part of the rest.Config client-go rejected (URL, TLS cert/key, or transport).","Regenerate the kubeconfig with `kops export kubecfg <cluster> --admin` to replace stale or corrupt credentials and server URL.","Verify the cluster's API endpoint in the kops state store (kops get cluster -oyaml, check spec.kubernetesApiAccess and master DNS name) is a valid https URL.","Confirm client certificate and key files exist, are unencrypted PEM, and match; re-export if certificates were rotated.","As a workaround for an unreachable/misconfigured API server workflow, run with --cloudonly, which skips client construction entirely."],"exampleFix":"// before\nrestConfig, err = f.RESTConfig(ctx, cluster, options.CreateKubecfgOptions)\n...\nk8sClient, err = kubernetes.NewForConfigAndClient(restConfig, httpClient)\nif err != nil {\n    return fmt.Errorf(\"cannot build kube client: %w\", err)\n}\n// after (cli-side: regenerate config first)\n// $ kops export kubecfg mycluster.example.com --admin\n// then rerun; or inspect the cause explicitly:\nif err != nil {\n    return fmt.Errorf(\"cannot build kube client (check kubeconfig/TLS material): %w\", err)\n}","handlingStrategy":"validation","validationCode":"cfg, err := f.RESTConfig(ctx, cluster, options.CreateKubecfgOptions)\nif err != nil {\n    return err\n}\nif u, err := url.Parse(cfg.Host); err != nil || u.Scheme == \"\" || u.Host == \"\" {\n    return fmt.Errorf(\"invalid API server host in rest config: %q\", cfg.Host)\n}\nif cfg.TLSClientConfig.Insecure == false && len(cfg.TLSClientConfig.CAData) == 0 && cfg.TLSClientConfig.CAFile == \"\" {\n    return fmt.Errorf(\"rest config has no CA data; re-export kubecfg\")\n}","typeGuard":null,"tryCatchPattern":"k8sClient, err := kubernetes.NewForConfigAndClient(restConfig, httpClient)\nif err != nil {\n    var uriErr *url.Error\n    if errors.As(err, &uriErr) {\n        return fmt.Errorf(\"cannot build kube client (bad host %q): %w\", restConfig.Host, err)\n    }\n    return fmt.Errorf(\"cannot build kube client (check kubeconfig/TLS): %w\", err)\n}","preventionTips":["Always generate kubeconfig via `kops export kubecfg` instead of hand-editing.","Validate the API server URL with url.Parse before building the client.","Keep client certificates/keys in sync with kops-managed rotation schedules.","Use --cloudonly when the k8s API path is known to be misconfigured."],"tags":["kubernetes","client-go","kubeconfig","tls"],"backgroundTag":"invalid-kube-client-config","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T07:17:12.445Z"}