{"record":{"id":"b8990d9a07c1bb8c","repo":"kubernetes/kops","slug":"building-kubernetes-client-w","errorCode":null,"errorMessage":"building kubernetes client: %w","messagePattern":"building kubernetes client: %w","errorType":"console","errorClass":null,"httpStatus":null,"severity":"error","filePath":"cmd/kops/get_instances.go","lineNumber":125,"sourceCode":"\n\tcloud, err := cloudup.BuildCloud(cluster)\n\tif err != nil {\n\t\treturn err\n\t}\n\n\trestConfig, err := f.RESTConfig(ctx, cluster, options.CreateKubecfgOptions)\n\tif err != nil {\n\t\treturn err\n\t}\n\n\thttpClient, err := f.HTTPClient(restConfig)\n\tif err != nil {\n\t\treturn err\n\t}\n\n\tk8sClient, err := kubernetes.NewForConfigAndClient(restConfig, httpClient)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"building kubernetes client: %w\", err)\n\t}\n\n\tnodeList, err := k8sClient.CoreV1().Nodes().List(ctx, metav1.ListOptions{})\n\tif err != nil {\n\t\tklog.Warningf(\"cannot list node names. Kubernetes API unavailable: %v\", err)\n\t}\n\n\tigList, err := clientset.InstanceGroupsFor(cluster).List(ctx, metav1.ListOptions{})\n\tif err != nil {\n\t\treturn err\n\t}\n\n\tvar instanceGroups []*kops.InstanceGroup\n\tfor i := range igList.Items {\n\t\tinstanceGroups = append(instanceGroups, &igList.Items[i])\n\t}\n\n\tvar cloudInstances []*cloudinstances.CloudInstance","sourceCodeStart":107,"sourceCodeEnd":143,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/cmd/kops/get_instances.go#L107-L143","documentation":"After building a REST config and HTTP client from the cluster's kubeconfig material, RunGetInstances constructs a client-go kubernetes clientset with kubernetes.NewForConfigAndClient. If clientset construction fails, the error is wrapped as \"building kubernetes client: %w\". This indicates malformed or incompatible client configuration (host, TLS material, content type, API version skew), not a network failure.","triggerScenarios":"`kops get instances` when restConfig contains an invalid host URL, unparseable certificate/key data, or unsupported config fields, causing kubernetes.NewForConfigAndClient (get_instances.go:123) to return a non-nil err.","commonSituations":"Corrupt or hand-edited kubeconfig entries; empty certificate-authority-data or base64 encoding mistakes; cluster spec pointing at an unreachable/malformed API server URL; mismatched client-go version expectations; proxies injecting bad config.","solutions":["Inspect the wrapped inner error after \"building kubernetes client:\" to see exactly which config field is invalid","Regenerate the kubeconfig via `kops export kubecfg <cluster> --admin` so TLS material and server URL are correct","Validate the resulting context with `kubectl cluster-info` using the same kubeconfig","Check the cluster spec (`kops get cluster -o yaml`) for a bogus/kubernetesApi endpoint value and fix or roll back the change","Upgrade/rebuild kops so client-go matches the target API server version"],"exampleFix":"// before: manually pasted, possibly invalid kubeconfig\nkubectl config use-context broken-context\n// after\nkops export kubecfg mycluster.example.com --admin\nkops get instances mycluster.example.com","handlingStrategy":"validation","validationCode":"// validate kubeconfig before running the command\nif ! kubectl --context \"$CTX\" cluster-info >/dev/null 2>&1; then\n  kops export kubecfg \"$CLUSTER\" --admin || exit 1\nfi\nkops get instances \"$CLUSTER\"","typeGuard":"func buildClientOrErr(restConfig *rest.Config, hc *http.Client) (*kubernetes.Clientset, error) {\n    if restConfig == nil || restConfig.Host == \"\" {\n        return nil, fmt.Errorf(\"rest config has no host\")\n    }\n    return kubernetes.NewForConfigAndClient(restConfig, hc)\n}","tryCatchPattern":"k8sClient, err := kubernetes.NewForConfigAndClient(restConfig, httpClient)\nif err != nil {\n    return fmt.Errorf(\"building kubernetes client: %w (check kubeconfig TLS material and server URL)\", err)\n}","preventionTips":["Never hand-edit kubeconfig certificate data; regenerate with `kops export kubecfg`","Verify with `kubectl cluster-info` before scripting against a cluster","Keep the kops API-version skew within supported range of the cluster","Avoid TLS-stripping proxies that mangle client config"],"tags":["kubernetes","client-go","kubeconfig","tls"],"backgroundTag":"kubernetes-client-build-failed","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T07:17:12.445Z"}