{"record":{"id":"796b02d1153284ed","repo":"kubernetes/kops","slug":"error-starting-challenge-listener-w","errorCode":null,"errorMessage":"error starting challenge listener: %w","messagePattern":"error starting challenge listener: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"upup/pkg/fi/nodeup/command.go","lineNumber":807,"sourceCode":"\t\t\treturn nil, err\n\t\t}\n\t\tauthenticator = a\n\n\tdefault:\n\t\treturn nil, fmt.Errorf(\"unsupported cloud provider for node configuration %s\", bootConfig.CloudProvider)\n\t}\n\n\tvar challengeListener *bootstrap.ChallengeListener\n\tif kopsmodel.UseChallengeCallback(bootConfig.CloudProvider) {\n\t\tchallengeServer, err := bootstrap.NewChallengeServer(bootConfig.ClusterName, []byte(bootConfig.ConfigServer.CACertificates))\n\t\tif err != nil {\n\t\t\treturn nil, err\n\t\t}\n\t\tlisten := \":\" + strconv.Itoa(wellknownports.NodeupChallenge)\n\n\t\tl, err := challengeServer.NewListener(ctx, listen)\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"error starting challenge listener: %w\", err)\n\t\t}\n\t\tchallengeListener = l\n\t\tdefer challengeListener.Stop()\n\t}\n\n\t// Note: The url is overridden in every iteration of the loop below.\n\tclient := kopscontrollerclient.NewWithTLSServerName(authenticator, []byte(bootConfig.ConfigServer.CACertificates), url.URL{}, bootConfig.ConfigServer.TLSServerName)\n\tdefer client.Close()\n\n\t// Any one of these servers may be permanently unreachable from this node -- an IPv6-only\n\t// cluster lists the load balancer's IPv4 address alongside its IPv6 one, and only the\n\t// latter is routable from the nodes. So give each server a short turn and keep cycling\n\t// through the list, rather than spending the whole budget on whichever happens to sort first.\n\tclient.Backoff = perServerBootstrapBackoff\n\n\tdeadline := time.Now().Add(bootstrapTimeout)\n\tfor {\n\t\tvar merr error","sourceCodeStart":789,"sourceCodeEnd":825,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/upup/pkg/fi/nodeup/command.go#L789-L825","documentation":"nodeup wraps any failure from challengeServer.NewListener (which opens a TCP listener on wellknownports.NodeupChallenge for the bootstrap challenge protocol) with this message. It is thrown by getNodeConfigFromServers while setting up the challenge listener used to authenticate node bootstrap requests. If the listener cannot bind, nodeup aborts before contacting the config server.","triggerScenarios":"challengeServer.NewListener fails when calling net.Listen on \":<NodeupChallenge port>\" — port already in use, insufficient privileges, or network namespace/socket errors.","commonSituations":"Another nodeup process or leftover container already holds the challenge port; running in a restricted environment (e.g. container without NET_BIND_SERVICE); port conflicts after node reboot with stale processes.","solutions":["Check what is bound to the NodeupChallenge port with `ss -ltnp | grep <port>` and kill the stale process","Restart the node or the nodeup systemd unit to clear stuck listeners","Verify the container/security context allows binding the port (NET_BIND_SERVICE capability)","Check kernel/network errors in nodeup logs preceding this message for the underlying net.Listen cause"],"exampleFix":null,"handlingStrategy":"fallback","validationCode":"// before starting nodeup\nconst challengePort = 3989\nln, err := net.Listen(\"tcp\", \":\"+strconv.Itoa(challengePort))\nif err != nil { return fmt.Errorf(\"challenge port %d unavailable: %w\", challengePort, err) }\nln.Close()","typeGuard":null,"tryCatchPattern":"if err := runNodeup(ctx); err != nil {\n  if strings.Contains(err.Error(), \"error starting challenge listener\") {\n    klog.Errorf(\"challenge listener port conflict; ensure port is free and rerun: %v\", err)\n  }\n}","preventionTips":["Reserve the NodeupChallenge port in your node images and don't run other services on it","Ensure nodeup runs with NET_BIND_SERVICE capability","Clean up stale nodeup processes on node reboot (systemd unit with Restart=on-failure)","Monitor for duplicate nodeup invocations in your bootstrap automation"],"tags":["network","nodeup","bootstrap"],"backgroundTag":"port-already-in-use","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T12:17:11.808Z"}