{"record":{"id":"c9a50f592b7f1d42","repo":"kubernetes/kops","slug":"getting-http-client-w-c9a50f","errorCode":null,"errorMessage":"getting http client: %w","messagePattern":"getting http client: %w","errorType":"error_code","errorClass":null,"httpStatus":null,"severity":"error","filePath":"cmd/kops/rolling-update_cluster.go","lineNumber":258,"sourceCode":"\t\treturn err\n\t}\n\n\tcluster, err := GetCluster(ctx, f, options.ClusterName)\n\tif err != nil {\n\t\treturn err\n\t}\n\n\tvar nodes []v1.Node\n\tvar k8sClient kubernetes.Interface\n\tif !options.CloudOnly {\n\t\trestConfig, err := f.RESTConfig(ctx, cluster, options.CreateKubecfgOptions)\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"getting rest config: %w\", err)\n\t\t}\n\n\t\thttpClient, err := f.HTTPClient(restConfig)\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"getting http client: %w\", err)\n\t\t}\n\n\t\tk8sClient, err = kubernetes.NewForConfigAndClient(restConfig, httpClient)\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"getting kubernetes client: %w\", err)\n\t\t}\n\n\t\tnodeList, err := k8sClient.CoreV1().Nodes().List(ctx, metav1.ListOptions{})\n\t\tif err != nil {\n\t\t\tfmt.Fprintf(os.Stderr, \"Unable to reach the kubernetes API.\\n\")\n\t\t\tfmt.Fprintf(os.Stderr, \"Use --cloudonly to do a rolling-update without confirming progress with the k8s API\\n\\n\")\n\t\t\treturn fmt.Errorf(\"error listing nodes in cluster: %v\", err)\n\t\t}\n\n\t\tif nodeList != nil {\n\t\t\tnodes = nodeList.Items\n\t\t}\n\t}","sourceCodeStart":240,"sourceCodeEnd":276,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/cmd/kops/rolling-update_cluster.go#L240-L276","documentation":"After obtaining the REST config, RunRollingUpdateCluster builds an HTTP client and a Kubernetes clientset with f.HTTPClient and kubernetes.NewForConfigAndClient. This error wraps a failure of f.HTTPClient(restConfig) — the HTTP transport for talking to the cluster API server could not be constructed (bad TLS material in the config, unsupported proxy/transport settings, or invalid CA/cert data).","triggerScenarios":"The REST config assembled in the previous step contains invalid TLS data (corrupt CA bundle or client cert), malformed proxy environment variables (HTTP_PROXY/HTTPS_PROXY), or incompatible transport options from CreateKubecfgOptions, causing client.HTTPClient to fail.","commonSituations":"Truncated or corrupted kubeconfig certificates (bad base64 in kubeconfig); corporate proxy misconfiguration via env vars; custom CA settings passed through CreateKubecfgOptions that don't parse; Go version / client-go TLS incompatibilities on the machine running kops.","solutions":["Read the wrapped error; validate the kubeconfig TLS blocks (`openssl x509 -in ca.crt -noout`) to rule out corrupt certs.","Unset/fix HTTP(S)_PROXY / NO_PROXY env vars and retry.","Re-export a fresh kubeconfig: `kops export kubecfg <cluster> --admin` to regenerate clean cert/CA data.","Simplify any custom rest-config options passed via --create-kubecfg-flags and retry with defaults."],"exampleFix":null,"handlingStrategy":"validation","validationCode":"// Sanity-check TLS material before building the client\ncfg, err := f.RESTConfig(ctx, cluster, opts)\nif err != nil { return err }\nfor _, ca := range cfg.CAData {\n    if _, err := x509.ParseCertificate(ca); err != nil {\n        return fmt.Errorf(\"corrupt CA data in rest config: %v\", err)\n    }\n}","typeGuard":null,"tryCatchPattern":"if strings.Contains(err.Error(), \"getting http client\") {\n    // TLS/proxy issue: clear proxy env, re-export kubeconfig, retry once\n    os.Unsetenv(\"HTTPS_PROXY\"); os.Unsetenv(\"HTTP_PROXY\")\n    exec.Command(\"kops\", \"export\", \"kubecfg\", clusterName, \"--admin\").Run()\n    return runRollingUpdate(...)\n}","preventionTips":["Keep proxy env vars (HTTP_PROXY/NO_PROXY) correct on machines running kops","Re-export the kubeconfig if certificates may be truncated or stale","Base64-decode and openssl-inspect kubeconfig cert blocks in preflight","Use consistent client-go/Go toolchain versions for kops builds"],"tags":["kops","rolling-update","http-client","tls","kubeconfig"],"backgroundTag":"tls-client-config-invalid","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T12:17:11.808Z"}