{"record":{"id":"51267e996c309625","repo":"gravitational/teleport","slug":"kubernetes-cluster-q-is-not-registered-or-is-offl","errorCode":null,"errorMessage":"kubernetes cluster %q is not registered or is offline","messagePattern":"kubernetes cluster %q is not registered or is offline","errorType":"error_code","errorClass":null,"httpStatus":null,"severity":"error","filePath":"lib/client/conntest/kube.go","lineNumber":231,"sourceCode":"\n\tif s.cfg.TLSRoutingEnabled {\n\t\t// passing an empty string to GetKubeTLSServerName results in\n\t\t// a server name = kube.teleport.cluster.local.\n\t\trestConfig.TLSClientConfig.ServerName = client.GetKubeTLSServerName(\"\")\n\t\trestConfig.Host = \"https://\" + s.webProxyAddr\n\t}\n\n\tclient, err := kubernetes.NewForConfig(restConfig)\n\treturn client, trace.Wrap(err)\n}\n\n// handleErrFromKube parses the errors received from the Teleport when generating\n// user credentials to access the cluster.\nfunc (s KubeConnectionTester) handleUserGenCertsErr(ctx context.Context, clusterName string, connectionDiagnosticID string, actionErr error) (types.ConnectionDiagnostic, error) {\n\tif trace.IsBadParameter(actionErr) {\n\t\tmessage := \"Failed to connect to Kubernetes cluster. Ensure the cluster is registered and online.\"\n\t\ttraceType := types.ConnectionDiagnosticTrace_CONNECTIVITY\n\t\terr := fmt.Errorf(\"kubernetes cluster %q is not registered or is offline\", clusterName)\n\t\treturn s.appendDiagnosticTrace(ctx, connectionDiagnosticID, traceType, message, err)\n\t} else if actionErr != nil {\n\t\treturn nil, trace.Wrap(actionErr)\n\t}\n\t// success message is delayed until we reach kube proxy since the agent can be\n\t// registered but unreachable\n\treturn nil, nil\n}\n\n// handleErrFromKube parses the errors received from the Teleport and marks the\n// steps according to the given error.\nfunc (s KubeConnectionTester) handleErrFromKube(ctx context.Context, clusterName string, connectionDiagnosticID string, actionErr error, namespace string) (types.ConnectionDiagnostic, error) {\n\tvar kubeErr *kubeerrors.StatusError\n\tif actionErr != nil && !errors.As(actionErr, &kubeErr) {\n\t\ttraceType := types.ConnectionDiagnosticTrace_UNKNOWN_ERROR\n\t\tmessage := fmt.Sprintf(\"Unknown error. %v\", actionErr)\n\t\tconnDiag, err := s.appendDiagnosticTrace(ctx, connectionDiagnosticID, traceType, message, actionErr)\n\t\treturn connDiag, trace.Wrap(err)","sourceCodeStart":213,"sourceCodeEnd":249,"githubUrl":"https://github.com/gravitational/teleport/blob/1283425b60ec5f60d509ba4c791183d452923ff7/lib/client/conntest/kube.go#L213-L249","documentation":"Returned by KubeConnectionTester.handleUserGenCertsErr when the user's attempt to mint Kubernetes access credentials for the target cluster fails because the cluster is not registered in the Teleport cluster or its kube service is offline, so no leaf certificates can be issued for it.","triggerScenarios":"Thrown at lib/client/conntest/kube.go:231 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Verify the Kubernetes cluster is registered: tsh clusters / tctl get kube_cluster","Check the target cluster and its kube service are online (tctl status, agent health)","Ensure the kube_service/discovery configuration includes this cluster","Retry the connection test after fixing registration"],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"1283425b60ec5f60d509ba4c791183d452923ff7","analyzedAt":"2026-09-02T04:06:41.601Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}