{"record":{"id":"5f3e761727171f29","repo":"kubernetes/kops","slug":"bootstrapping-node-labels-w","errorCode":null,"errorMessage":"bootstrapping node labels: %w","messagePattern":"bootstrapping node labels: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"channels/pkg/cmd/apply_channel.go","lineNumber":111,"sourceCode":"\t\t\tlabels[pair[0]] = pair[1]\n\t\t} else {\n\t\t\tlabels[rawpair] = \"\"\n\t\t}\n\t}\n\treturn labels, nil\n}\n\n// runApplyChannelIteration patches node labels (when --node-name is set) then\n// applies the channel. Labels go first so addons targeting the control-plane\n// label can schedule on the local node as soon as their manifests land.\nfunc runApplyChannelIteration(ctx context.Context, f *ChannelsFactory, out io.Writer, options *ApplyChannelOptions, args []string) error {\n\tvar merr error\n\tif options.NodeName != \"\" {\n\t\tlabelerClient, err := f.KubernetesClient()\n\t\tif err != nil {\n\t\t\tmerr = multierr.Append(merr, fmt.Errorf(\"building kubernetes client for node labeler: %w\", err))\n\t\t} else if err := nodelabeler.BootstrapControlPlaneNodeLabels(ctx, labelerClient, options.NodeName, options.NodeLabels); err != nil {\n\t\t\tmerr = multierr.Append(merr, fmt.Errorf(\"bootstrapping node labels: %w\", err))\n\t\t}\n\t}\n\tif err := RunApplyChannel(ctx, f, out, options, args); err != nil {\n\t\tmerr = multierr.Append(merr, err)\n\t}\n\treturn merr\n}\n\n// runApplyChannelLoop reconciles repeatedly until ctx is cancelled. A fresh\n// ChannelsFactory per iteration drops cached REST configs and the discovery\n// cache, picking up cert rotation and new CRDs without a restart.\nfunc runApplyChannelLoop(ctx context.Context, out io.Writer, options *ApplyChannelOptions, args []string) error {\n\t// In daemon mode kops-channels runs as a system-node-critical static pod; serve a\n\t// readiness probe reporting the last apply outcome, so a persistent failure surfaces\n\t// as NotReady (failing `kops validate cluster`, which gates rolling updates) instead\n\t// of only being logged. Starts NotReady until the first successful apply.\n\treadiness, err := serveReadiness(ctx)\n\tif err != nil {","sourceCodeStart":93,"sourceCodeEnd":129,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/channels/pkg/cmd/apply_channel.go#L93-L129","documentation":"When --node-name is set, runApplyChannelIteration calls nodelabeler.BootstrapControlPlaneNodeLabels to patch the named node with the given labels. Any failure from that call (node not found, API error, patch rejected) is wrapped with this message and merged into the multierr, so the channel apply still proceeds but the error is reported.","triggerScenarios":"`kops channels --node-name <node> --node-labels k=v` where the node does not exist, the apiserver rejects the patch (RBAC, conflict), the node is NotReady, or the API request times out.","commonSituations":"Stale --node-name after node replacement; RBAC denying nodes/status patch for the channels service account; apiserver briefly unavailable during control-plane bootstrap; label keys/values violating Kubernetes label rules.","solutions":["Verify the node exists: `kubectl get node <node-name>` and that --node-name matches exactly","Check RBAC allows patch/update on nodes for the channels identity","Retry after the control plane is ready; the daemon loop retries automatically","Validate label key/value syntax conforms to Kubernetes label constraints"],"exampleFix":null,"handlingStrategy":"retry","validationCode":"// Go: confirm the node exists and is Ready before labeling\nn, err := clientset.CoreV1().Nodes().Get(ctx, nodeName, metav1.GetOptions{})\nif err != nil || !isNodeReady(n) {\n\treturn fmt.Errorf(\"node %s not ready for labeling\", nodeName)\n}","typeGuard":null,"tryCatchPattern":"err := runApplyChannelIteration(ctx, f, out, options, args)\nif err != nil && strings.Contains(err.Error(), \"bootstrapping node labels\") {\n\t// transient apiserver errors: back off and retry\n\ttime.Sleep(5 * time.Second)\n\treturn retry(ctx)\n}","preventionTips":["Ensure RBAC grants nodes patch permission to the channels identity","Keep --node-name in sync with actual node names (downward API metadata.name)","Treat label bootstrap as idempotent and retriable","Validate label keys/values before applying"],"tags":["kubernetes","node-labels","rbac","api-error"],"backgroundTag":"node-label-bootstrap-failed","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T07:17:12.445Z"}