{"record":{"id":"bed9ea3876bb9e44","repo":"kubernetes/kops","slug":"kubeproxy-not-configured","errorCode":null,"errorMessage":"KubeProxy not configured","messagePattern":"KubeProxy not configured","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"nodeup/pkg/model/kube_proxy.go","lineNumber":107,"sourceCode":"\n\t{\n\t\tc.AddTask(&nodetasks.File{\n\t\t\tPath:        \"/var/log/kube-proxy.log\",\n\t\t\tContents:    fi.NewStringResource(\"\"),\n\t\t\tType:        nodetasks.FileType_File,\n\t\t\tMode:        s(\"0400\"),\n\t\t\tIfNotExists: true,\n\t\t})\n\t}\n\n\treturn nil\n}\n\n// buildPod is responsible constructing the pod spec\nfunc (b *KubeProxyBuilder) buildPod() (*v1.Pod, error) {\n\tc := b.NodeupConfig.KubeProxy\n\tif c == nil {\n\t\treturn nil, fmt.Errorf(\"KubeProxy not configured\")\n\t}\n\n\t// On distributions where iptables is not functional (e.g., RHEL10+),\n\t// we must use nftables proxy mode instead.\n\t// In particular when we forced nftables on rhel10, we should also pass the --proxy-mode=nftables flag.\n\tif b.Distribution.ForceNftables() {\n\t\tif c.ProxyMode == \"\" || c.ProxyMode == \"iptables\" {\n\t\t\tklog.Infof(\"Distribution %v requires nftables; overriding kube-proxy mode from %q to nftables\", b.Distribution, c.ProxyMode)\n\t\t\tc.ProxyMode = \"nftables\"\n\t\t}\n\t}\n\n\tif c.Master == \"\" {\n\t\tif b.HasAPIServer {\n\t\t\t// Use the local API server to avoid a kube-proxy/DNS bootstrap cycle. Dedicated\n\t\t\t// apiserver nodes also lack an /etc/hosts entry for the API internal name.\n\t\t\tc.Master = \"https://127.0.0.1\"\n\t\t} else {","sourceCodeStart":89,"sourceCodeEnd":125,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/nodeup/pkg/model/kube_proxy.go#L89-L125","documentation":"KubeProxyBuilder.buildPod requires a KubeProxy configuration from the nodeup config (b.NodeupConfig.KubeProxy). If it is nil, nodeup cannot construct the kube-proxy static pod at all and returns 'KubeProxy not configured'. nodeup refuses to guess defaults: kube-proxy settings must be present in the config handed to the binary.","triggerScenarios":"Build -> buildPod is invoked on a node whose NodeupConfig has a nil KubeProxy field — i.e. the nodeup config file/struct passed to nodeup lacks the kubeProxy section.","commonSituations":"Hand-crafted or copied NodeupConfig files missing kubeProxy; running an old nodeup against config produced by a newer kops (or vice versa) where the struct layout changed; partially failed `kops update cluster` that did not push a complete config; kube-proxy intentionally removed from the cluster spec while nodeup still expects it.","solutions":["Regenerate the node's config with `kops update cluster --yes` (and rolling update) so NodeupConfig includes spec.kubeProxy","Verify the cluster spec has a kubeProxy section: `kops get cluster -o yaml | grep -A5 kubeProxy`; re-add it via `kops edit cluster` if missing","Ensure the nodeup binary version matches the kops version that generated the config","If kube-proxy is intentionally not used, use a nodeup/kops flow that supports omitting it rather than a nil config"],"exampleFix":"// before (cluster spec missing kube-proxy)\nspec:\n  kubelet: {}\n// after (kops edit cluster)\nspec:\n  kubeProxy:\n    enabled: true\n    master: https://api.internal.example.com\n# then: kops update cluster --yes && kops rolling-update cluster --yes","handlingStrategy":"validation","validationCode":"func validateKubeProxyConfig(cfg *nodeup.Config) error {\n    if cfg == nil || cfg.KubeProxy == nil {\n        return errors.New(\"KubeProxy not configured: NodeupConfig.KubeProxy must be set before running nodeup\")\n    }\n    return nil\n}\n// call before launching nodeup","typeGuard":"func kubeProxyConfigured(b *KubeProxyBuilder) bool {\n    return b != nil && b.NodeupConfig != nil && b.NodeupConfig.KubeProxy != nil\n}","tryCatchPattern":"if err := b.buildPod(); err != nil {\n    if strings.Contains(err.Error(), \"KubeProxy not configured\") {\n        // regenerate NodeupConfig from cluster spec and retry\n    }\n    return err\n}","preventionTips":["Ensure spec.kubeProxy exists in the cluster spec before provisioning nodes","Always let `kops update cluster --yes` generate the NodeupConfig; never hand-write it","Verify kops and nodeup versions match on every node role","After any kops upgrade, run a rolling update so node configs are fully refreshed"],"tags":["go","kubernetes","nodeup","kube-proxy","missing-config"],"backgroundTag":"missing-config-field","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T07:17:12.445Z"}