{"record":{"id":"7d10177be7315ffe","repo":"kubernetes/kops","slug":"error-building-kubeproxy-flags-v","errorCode":null,"errorMessage":"error building kubeproxy flags: %v","messagePattern":"error building kubeproxy flags: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"nodeup/pkg/model/kube_proxy.go","lineNumber":154,"sourceCode":"\t\tresourceLimits[\"cpu\"] = *c.CPULimit\n\t}\n\n\tif c.MemoryRequest != nil {\n\t\tresourceRequests[\"memory\"] = *c.MemoryRequest\n\t}\n\n\tif c.MemoryLimit != nil {\n\t\tresourceLimits[\"memory\"] = *c.MemoryLimit\n\t}\n\n\tif c.ConntrackMaxPerCore == nil {\n\t\tdefaultConntrackMaxPerCore := int32(131072)\n\t\tc.ConntrackMaxPerCore = &defaultConntrackMaxPerCore\n\t}\n\n\tflags, err := flagbuilder.BuildFlagsList(c)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"error building kubeproxy flags: %v\", err)\n\t}\n\n\tflags = append(flags, []string{\n\t\t\"--kubeconfig=/var/lib/kube-proxy/kubeconfig\",\n\t\t\"--oom-score-adj=-998\",\n\t}...)\n\n\timage := b.RemapImage(c.Image)\n\n\tcontainer := &v1.Container{\n\t\tName:  \"kube-proxy\",\n\t\tImage: image,\n\t\tResources: v1.ResourceRequirements{\n\t\t\tRequests: resourceRequests,\n\t\t\tLimits:   resourceLimits,\n\t\t},\n\t\tSecurityContext: &v1.SecurityContext{\n\t\t\tPrivileged: new(true),","sourceCodeStart":136,"sourceCodeEnd":172,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/nodeup/pkg/model/kube_proxy.go#L136-L172","documentation":"nodeup's KubeProxyBuilder builds the kube-proxy static pod and uses flagbuilder.BuildFlagsList to serialize the KubeProxyConfig struct into kube-proxy CLI flags. When that reflection-based flag builder returns an error (typically a field whose flag tag is invalid or a type it cannot render), the builder wraps it with \"error building kubeproxy flags: %v\" and aborts building the kube-proxy task, so the node manifest fails to generate.","triggerScenarios":"Running nodeup model construction (KubeProxyBuilder.Build -> buildPod) with a KubeProxyConfig containing a value flagbuilder cannot convert — e.g. an unsupported field type introduced by a config schema change or a malformed custom kube-proxy config in the cluster spec.","commonSituations":"Clusters with hand-edited cluster.yaml / kops cluster spec fields under kubeProxy; upgrading kops versions where KubeProxyConfig gained fields the flag builder mis-handles; generated manifests in CI where config was populated from JSON/YAML with unexpected types.","solutions":["Inspect the wrapped inner error to identify which KubeProxyConfig field failed flag conversion","Fix or remove the offending field in the cluster spec (kops edit cluster) and re-run kops update/replace","Validate the cluster spec with kops toolbox dump / kops validate before running nodeup","If caused by a kops bug, upgrade to a patched kops release"],"exampleFix":"// before (spec)\nkubeProxy:\n  proxyMode: \"iptables \"   # trailing space / invalid value passes through to flag builder\n// after\nkops edit cluster  # set kubeProxy.proxyMode: iptables\nkops update cluster --yes && kops rolling-update cluster --yes","handlingStrategy":"validation","validationCode":"// Validate kube-proxy config fields before generating the manifest\ncfg := cluster.Spec.KubeProxy\nif cfg != nil && cfg.ProxyMode != \"\" {\n\tvalid := map[string]bool{\"iptables\": true, \"ipvs\": true, \"nftables\": true}\n\tif !valid[cfg.ProxyMode] {\n\t\treturn fmt.Errorf(\"invalid kubeProxy.proxyMode %q\", cfg.ProxyMode)\n\t}\n}\n// Optionally pre-render flags in a dry-run to catch flagbuilder issues early\nif _, err := flagbuilder.BuildFlagsList(cfg); err != nil {\n\treturn fmt.Errorf(\"kubeProxy config cannot be rendered to flags: %w\", err)\n}","typeGuard":null,"tryCatchPattern":"// nodeup is not caller-recoverable; capture and surface the wrapped cause\nif err := runNodeupModel(); err != nil {\n\tif strings.Contains(err.Error(), \"error building kubeproxy flags\") {\n\t\tlog.Errorf(\"kube-proxy flag build failed, check kubeProxy config: %v\", err)\n\t}\n\treturn err\n}","preventionTips":["Never hand-edit kubeProxy fields without validating the full cluster spec (kops validate)","Keep the nodeup binary version in lockstep with the kops version that wrote the state store","Run kops update cluster with --dry-run in CI to render manifests before applying"],"tags":["go","nodeup","kube-proxy","flag-builder"],"backgroundTag":"flag-build-failed","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T12:17:11.808Z"}