{"record":{"id":"6535ac4480df1d72","repo":"kubernetes/kops","slug":"failed-to-add-the-s-kubelet-credential-provider","errorCode":null,"errorMessage":"failed to add the %s kubelet credential provider: %w","messagePattern":"failed to add the (.+?) kubelet credential provider: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"nodeup/pkg/model/kubelet.go","lineNumber":230,"sourceCode":"\t\t\t\tType:           nodetasks.FileType_File,\n\t\t\t\tMode:           s(\"0400\"),\n\t\t\t\tBeforeServices: []string{kubeletService},\n\t\t\t})\n\t\t}\n\t}\n\n\tif !b.NodeupConfig.UsesKubenet {\n\t\tc.AddTask(&nodetasks.File{\n\t\t\tPath: b.CNIConfDir(),\n\t\t\tType: nodetasks.FileType_Directory,\n\t\t})\n\t}\n\n\tif b.UseExternalKubeletCredentialProvider() {\n\t\tswitch b.CloudProvider() {\n\t\tcase kops.CloudProviderGCE:\n\t\t\tif err := b.addGCPCredentialProvider(c); err != nil {\n\t\t\t\treturn fmt.Errorf(\"failed to add the %s kubelet credential provider: %w\", b.CloudProvider(), err)\n\t\t\t}\n\t\tcase kops.CloudProviderAWS:\n\t\t\tif err := b.addECRCredentialProvider(c); err != nil {\n\t\t\t\treturn fmt.Errorf(\"failed to add the %s kubelet credential provider: %w\", b.CloudProvider(), err)\n\t\t\t}\n\t\t}\n\t}\n\n\t{\n\t\tcgroup := kubeletConfig.KubeletCgroups\n\t\tif cgroup != \"\" {\n\t\t\tc.EnsureTask(b.buildCgroupService(cgroup))\n\t\t}\n\n\t}\n\t{\n\t\tcgroup := kubeletConfig.RuntimeCgroups\n\t\tif cgroup != \"\" {","sourceCodeStart":212,"sourceCodeEnd":248,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/nodeup/pkg/model/kubelet.go#L212-L248","documentation":"When UseExternalKubeletCredentialProvider is enabled and the cloud provider is GCE, Build calls addGCPCredentialProvider to configure the kubelet image credential provider; its failure is wrapped with the provider name (e.g. \"gce\").","triggerScenarios":"addGCPCredentialProvider returns an error while building the GCP credential provider config/volume tasks — e.g. missing image for the credential provider binary or failure creating its file/config tasks.","commonSituations":"GCP clusters with external credential providers enabled but the required provider binary/asset missing from the asset store, or invalid GCP auth config.","solutions":["Inspect the wrapped %w error for the root cause (missing asset vs task build failure).","Ensure the GCP auth provider image/binary asset is available in the cluster's asset store.","If you do not need external credential providers, disable UseKubeletCredentialProvider in the cluster spec.","Verify GCE-specific cluster spec fields (registry/auth config) are correct."],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":"// ensure the GCP credential provider image/binary is present before enabling\n// in cluster spec:\n// kubelet:\n//   useKubeletCredentialProvider: true\n// verify asset:\n// kops get cluster -o yaml | grep -i credential","typeGuard":null,"tryCatchPattern":"err := runNodeup(ctx)\nif err != nil && strings.Contains(err.Error(), \"kubelet credential provider\") {\n    return fmt.Errorf(\"credential provider setup failed: %w\", err)\n}","preventionTips":["Only enable useKubeletCredentialProvider on kOps versions that bundle the provider assets.","Confirm the provider image is pullable/asset present before rolling nodes.","Fall back to built-in auth if the provider asset cannot be staged."],"tags":["nodeup","kubelet","gcp","credential-provider"],"backgroundTag":"credential-provider-setup-failed","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T07:17:12.445Z"}