{"record":{"id":"5929b27fd9fd1cff","repo":"kubernetes/kops","slug":"getting-kubernetes-client-w","errorCode":null,"errorMessage":"getting kubernetes client: %w","messagePattern":"getting kubernetes client: %w","errorType":"error_code","errorClass":null,"httpStatus":null,"severity":"error","filePath":"cmd/kops/rolling-update_cluster.go","lineNumber":263,"sourceCode":"\t\treturn err\n\t}\n\n\tvar nodes []v1.Node\n\tvar k8sClient kubernetes.Interface\n\tif !options.CloudOnly {\n\t\trestConfig, err := f.RESTConfig(ctx, cluster, options.CreateKubecfgOptions)\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"getting rest config: %w\", err)\n\t\t}\n\n\t\thttpClient, err := f.HTTPClient(restConfig)\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"getting http client: %w\", err)\n\t\t}\n\n\t\tk8sClient, err = kubernetes.NewForConfigAndClient(restConfig, httpClient)\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"getting kubernetes client: %w\", err)\n\t\t}\n\n\t\tnodeList, err := k8sClient.CoreV1().Nodes().List(ctx, metav1.ListOptions{})\n\t\tif err != nil {\n\t\t\tfmt.Fprintf(os.Stderr, \"Unable to reach the kubernetes API.\\n\")\n\t\t\tfmt.Fprintf(os.Stderr, \"Use --cloudonly to do a rolling-update without confirming progress with the k8s API\\n\\n\")\n\t\t\treturn fmt.Errorf(\"error listing nodes in cluster: %v\", err)\n\t\t}\n\n\t\tif nodeList != nil {\n\t\t\tnodes = nodeList.Items\n\t\t}\n\t}\n\n\tlist, err := clientset.InstanceGroupsFor(cluster).List(ctx, metav1.ListOptions{})\n\tif err != nil {\n\t\treturn err\n\t}","sourceCodeStart":245,"sourceCodeEnd":281,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/cmd/kops/rolling-update_cluster.go#L245-L281","documentation":"RunRollingUpdateCluster builds a Kubernetes client from the REST config so it can poll node/draining state during a rolling update. If client-go's kubernetes.NewForConfigAndClient fails — e.g. because the REST config is malformed (bad host URL, invalid TLS material) — it wraps the error as \"getting kubernetes client: %w\". This means the k8s API client could not even be constructed, before any network request was made.","triggerScenarios":"kubernetes.NewForConfigAndClient(restConfig, httpClient) returns an error: the restConfig obtained from f.RESTConfig(ctx, cluster, options.CreateKubecfgOptions) has an invalid API server URL, unparseable CA cert/client cert/key, or unsupported transport settings (only when --cloudonly is NOT set).","commonSituations":"Stale or hand-edited kubeconfig for the cluster (wrong server host, expired/rotated client certificates, corrupt CA data); kops admin kubeconfig regenerated with a different CA; pointing at a custom API endpoint with a malformed URL scheme.","solutions":["Verify the kubeconfig used by kops (kops export kubeconfig <cluster> --admin) and regenerate it if certificates were rotated","Inspect the wrapped cause in %w for which field is invalid (host URL vs TLS material) and fix that field","Run with --cloudonly to skip k8s client construction if API-side validation is not needed","Ensure the kubectl context points at the correct cluster: kubectl config current-context"],"exampleFix":"// before: stale kubeconfig with rotated CA\nkops rolling-update cluster mycluster.k8s.local\n// error: getting kubernetes client: ... tls: failed to find any PEM data\n// after\nkops export kubeconfig mycluster.k8s.local --admin\nkops rolling-update cluster mycluster.k8s.local","handlingStrategy":"try-catch","validationCode":"// validate kubeconfig before running\ncfg, err := clientcmd.NewNonInteractiveDeferredLoadingClientConfig(\n    clientcmd.NewDefaultClientConfigLoadingRules(), nil).ClientConfig()\nif err != nil { return fmt.Errorf(\"kubeconfig invalid: %w\", err) }\nif cfg.Host == \"\" || len(cfg.CAData) == 0 { return errors.New(\"kubeconfig missing host or CA\") }","typeGuard":"func restConfigUsable(c *rest.Config) bool {\n    return c != nil && c.Host != \"\" && (len(c.CAData) > 0 || c.CAFile != \"\")\n}","tryCatchPattern":"if err != nil {\n    var perr error\n    if errors.As(err, &perr) { klog.Infof(\"cause: %v\", perr) }\n    return fmt.Errorf(\"building k8s client failed: %w; run `kops export kubeconfig <cluster> --admin`\", err)\n}","preventionTips":["Regenerate kubeconfig after cert rotation: kops export kubeconfig <cluster> --admin","Never hand-edit certificate blocks in kubeconfig","Validate with `kubectl get nodes` using the same kubeconfig before kops operations","Use --cloudonly when API connectivity is known to be unavailable"],"tags":["kubernetes","client","kubeconfig","tls"],"backgroundTag":"invalid-kubeconfig","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T07:17:12.445Z"}