{"record":{"id":"7539b13840a4abfb","repo":"kubernetes/kops","slug":"error-building-kube-apiserver-flags-v","errorCode":null,"errorMessage":"error building kube-apiserver flags: %v","messagePattern":"error building kube-apiserver flags: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"nodeup/pkg/model/kube_apiserver.go","lineNumber":628,"sourceCode":"\n\t// @fixup: the admission controller migrated from --admission-control to --enable-admission-plugins, but\n\t// most people will still have c.Spec.KubeAPIServer.AdmissionControl references into their configuration we need\n\t// to fix up. A PR https://github.com/kubernetes/kops/pull/5221/ introduced the issue and since the command line\n\t// flags are mutually exclusive the API refuses to come up.\n\t{\n\t\t// @note: note sure if this is the best place to put it, I could place into the validation.go which has the benefit of\n\t\t// fixing up the manifests itself, but that feels VERY hacky\n\t\t// @note: it's fine to use AdmissionControl here and it's not populated by the model, thus the only data could have come from the cluster spec\n\t\tif len(kubeAPIServer.AdmissionControl) > 0 {\n\t\t\tkubeAPIServer.EnableAdmissionPlugins = append([]string(nil), kubeAPIServer.AdmissionControl...)\n\t\t\tkubeAPIServer.AdmissionControl = []string{}\n\t\t}\n\t}\n\n\t// build the kube-apiserver flags for the service\n\tflags, err := flagbuilder.BuildFlagsList(kubeAPIServer)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"error building kube-apiserver flags: %v\", err)\n\t}\n\n\tpod := &v1.Pod{\n\t\tTypeMeta: metav1.TypeMeta{\n\t\t\tAPIVersion: \"v1\",\n\t\t\tKind:       \"Pod\",\n\t\t},\n\t\tObjectMeta: metav1.ObjectMeta{\n\t\t\tName:        \"kube-apiserver\",\n\t\t\tNamespace:   \"kube-system\",\n\t\t\tAnnotations: b.buildAnnotations(),\n\t\t\tLabels: map[string]string{\n\t\t\t\t\"k8s-app\": \"kube-apiserver\",\n\t\t\t},\n\t\t},\n\t\tSpec: v1.PodSpec{\n\t\t\tHostNetwork: true,\n\t\t},","sourceCodeStart":610,"sourceCodeEnd":646,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/nodeup/pkg/model/kube_apiserver.go#L610-L646","documentation":"Wraps a failure of the flag-building helper in buildPod: the kube-apiserver command-line flags (including the admission-controller fixups) could not be constructed from the APIServerConfig, so the pod spec cannot be completed.","triggerScenarios":"Thrown at nodeup/pkg/model/kube_apiserver.go:628 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Check kubeAPIServer flag settings in the cluster spec","Remove deprecated admission-control settings","Re-run nodeup after spec fixes"],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T07:17:12.445Z"}