{"record":{"id":"79f47782ee62f877","repo":"kubernetes/kops","slug":"building-kube-client-w","errorCode":null,"errorMessage":"building kube client: %w","messagePattern":"building kube client: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"channels/pkg/cmd/apply_channel.go","lineNumber":170,"sourceCode":"\t\t\treturn nil\n\t\tcase <-time.After(interval):\n\t\t}\n\t}\n}\n\nfunc RunApplyChannel(ctx context.Context, f *ChannelsFactory, out io.Writer, options *ApplyChannelOptions, args []string) error {\n\trestConfig, err := f.RESTConfig()\n\tif err != nil {\n\t\treturn err\n\t}\n\thttpClient, err := f.HTTPClient()\n\tif err != nil {\n\t\treturn err\n\t}\n\n\tk8sClient, err := f.KubernetesClient()\n\tif err != nil {\n\t\treturn fmt.Errorf(\"building kube client: %w\", err)\n\t}\n\n\tcmClient, err := certmanager.NewForConfigAndClient(restConfig, httpClient)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"building cert manager client: %w\", err)\n\t}\n\n\tdynamicClient, err := f.DynamicClient()\n\tif err != nil {\n\t\treturn fmt.Errorf(\"building dynamic client: %w\", err)\n\t}\n\n\trestMapper, err := f.RESTMapper()\n\tif err != nil {\n\t\treturn err\n\t}\n\n\tkubernetesVersionInfo, err := k8sClient.Discovery().ServerVersion()","sourceCodeStart":152,"sourceCodeEnd":188,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/channels/pkg/cmd/apply_channel.go#L152-L188","documentation":"RunApplyChannel wraps failures from f.KubernetesClient() with this message while assembling the clients it needs (clientset, cert-manager client, dynamic client, REST mapper). The inner error is the client-go clientset construction failure, typically from a bad REST config or transport setup.","triggerScenarios":"Any `kops channels apply` invocation where the clientset cannot be built: invalid kubeconfig, unreadable CA/client certificate files, unsupported auth scheme in the REST config.","commonSituations":"Expired or missing client certificates; kubeconfig referencing files that do not exist in the container; incompatible kubeconfig with the compiled client-go version.","solutions":["Confirm the REST config is valid: run `kubectl --kubeconfig <path> version` against the same cluster","Check that all cert/key file paths referenced by the kubeconfig exist and are readable","Regenerate or refresh the admin kubeconfig (`kops export kubeconfig`)","Inspect the wrapped error for the specific config field that failed"],"exampleFix":"// before: cert file missing\nerror building kube client: open /etc/kubernetes/pki/client.crt: no such file or directory\n// after: regenerate config\nkops export kubeconfig --name mycluster.example.com --kubeconfig ~/.kube/config","handlingStrategy":"try-catch","validationCode":"// Go: verify the REST config loads and is complete first\nrestConfig, err := f.RESTConfig()\nif err != nil || restConfig.Host == \"\" {\n\treturn fmt.Errorf(\"precheck: REST config invalid: %v\", err)\n}","typeGuard":null,"tryCatchPattern":"err := RunApplyChannel(ctx, f, out, options, args)\nif err != nil {\n\tvar inner error\n\tif strings.Contains(err.Error(), \"building kube client\") {\n\t\tklog.Errorf(\"kube client init failed: %v\", err) // inspect wrapped cause\n\t\t_ = inner\n\t}\n}","preventionTips":["Regenerate kubeconfig via kops export kubeconfig after cert rotation","Ensure cert/key/CA paths in kubeconfig exist inside containers","Pin client-go/kops versions compatible with your cluster","Fail fast with a preflight `kubectl auth can-i get nodes` check"],"tags":["kubernetes","client-init","kubeconfig","tls"],"backgroundTag":"kube-client-init-failed","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T07:17:12.445Z"}