{"record":{"id":"850bc9d35fbca6d4","repo":"kubernetes/kops","slug":"error-building-node-labels-w-850bc9","errorCode":null,"errorMessage":"error building node labels: %w","messagePattern":"error building node labels: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"upup/pkg/fi/cloudup/populate_instancegroup_spec.go","lineNumber":280,"sourceCode":"\t\t\tigKubeletConfig = &kops.KubeletConfigSpec{}\n\t\t}\n\t\t// A few settings in Kubelet override those in ControlPlaneKubelet. I'm not sure why.\n\t\tif cluster.Spec.Kubelet != nil && cluster.Spec.Kubelet.AnonymousAuth != nil && !*cluster.Spec.Kubelet.AnonymousAuth {\n\t\t\tigKubeletConfig.AnonymousAuth = new(false)\n\t\t}\n\t} else {\n\t\tif cluster.Spec.Kubelet != nil {\n\t\t\tigKubeletConfig = cluster.Spec.Kubelet.DeepCopy()\n\t\t} else {\n\t\t\tigKubeletConfig = &kops.KubeletConfigSpec{}\n\t\t}\n\t}\n\n\t// We include the NodeLabels in the userdata even for Kubernetes 1.16 and later so that\n\t// rolling update will still replace nodes when they change.\n\tnodeLabels, err := nodelabels.BuildNodeLabels(cluster, ig)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"error building node labels: %w\", err)\n\t}\n\tigKubeletConfig.NodeLabels = nodeLabels\n\n\tuseSecureKubelet := fi.ValueOf(igKubeletConfig.AnonymousAuth)\n\n\t// While slices are overridden in most cases, taints are explicitly merged\n\ttaints := sets.NewString(igKubeletConfig.Taints...)\n\ttaints.Insert(igSpec.Taints...)\n\tif ig.Spec.Kubelet != nil {\n\t\ttaints.Insert(igSpec.Kubelet.Taints...)\n\t}\n\tif cluster.Spec.Kubelet != nil {\n\t\ttaints.Insert(cluster.Spec.Kubelet.Taints...)\n\t}\n\tif ig.Spec.Kubelet != nil {\n\t\treflectutils.JSONMergeStruct(igKubeletConfig, ig.Spec.Kubelet)\n\t}\n","sourceCodeStart":262,"sourceCodeEnd":298,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/upup/pkg/fi/cloudup/populate_instancegroup_spec.go#L262-L298","documentation":"kOps builds the kubelet node labels for the InstanceGroup via nodelabels.BuildNodeLabels(cluster, ig). This error wraps any failure there — typically invalid or disallowed labels/roles that the builder refuses to assemble.","triggerScenarios":"spec.kubelet.nodeLabels (or cluster-level equivalents) containing labels BuildNodeLabels cannot validate or merge — e.g. labels violating kubernetes label value constraints, or internal label conflicts with role-derived labels.","commonSituations":"Custom nodeLabels with invalid characters or overly long values; labels colliding with kops-managed keys (kops.k8s.io/*, kubernetes.io/role); config applied via `kops create cluster --set` producing malformed label strings.","solutions":["Check the wrapped error message for the offending label and fix its key/value to satisfy Kubernetes label constraints (63 chars, alphanumerics, -, _, .)","Remove labels that clash with kops/kubernetes reserved prefixes","Run `kops toolbox instance-selector` or validate the IG with `kops validate` after editing","Verify kubelet config in `kops edit cluster` / `kops edit instancegroup`"],"exampleFix":"// before\nspec:\n  kubelet:\n    nodeLabels:\n      node-role.kubernetes.io/node=: this_is_a_way_too_long_label_value_that_exceeds_the_sixty_three_character_limit\n// after\nspec:\n  kubelet:\n    nodeLabels:\n      workload: general","handlingStrategy":"validation","validationCode":"// Validate node labels against k8s constraints before applying\nre := regexp.MustCompile(`^(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])?$`)\nfor k, v := range ig.Spec.Kubelet.NodeLabels {\n    if len(v) > 63 || !re.MatchString(v) {\n        return fmt.Errorf(\"invalid node label value %q for key %s\", v, k)\n    }\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Keep label values <=63 chars matching [A-Za-z0-9][-A-Za-z0-9_.]*[A-Za-z0-9]","Avoid reserved prefixes: kops.k8s.io/, kubernetes.io/, node-role.kubernetes.io/ (set roles via spec.role)","Validate cluster/IG specs with `kops update cluster --dry-run` before apply"],"tags":["kops","kubelet","node-labels","validation"],"backgroundTag":"invalid-node-label","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T07:17:12.445Z"}