{"record":{"id":"dcd609e65012d571","repo":"kubernetes/kops","slug":"getting-rest-config-w-dcd609","errorCode":null,"errorMessage":"getting rest config: %w","messagePattern":"getting rest config: %w","errorType":"error_code","errorClass":null,"httpStatus":null,"severity":"error","filePath":"cmd/kops/rolling-update_cluster.go","lineNumber":253,"sourceCode":"}\n\nfunc RunRollingUpdateCluster(ctx context.Context, f *util.Factory, out io.Writer, options *RollingUpdateOptions) error {\n\tclientset, err := f.KopsClient()\n\tif err != nil {\n\t\treturn err\n\t}\n\n\tcluster, err := GetCluster(ctx, f, options.ClusterName)\n\tif err != nil {\n\t\treturn err\n\t}\n\n\tvar nodes []v1.Node\n\tvar k8sClient kubernetes.Interface\n\tif !options.CloudOnly {\n\t\trestConfig, err := f.RESTConfig(ctx, cluster, options.CreateKubecfgOptions)\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"getting rest config: %w\", err)\n\t\t}\n\n\t\thttpClient, err := f.HTTPClient(restConfig)\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"getting http client: %w\", err)\n\t\t}\n\n\t\tk8sClient, err = kubernetes.NewForConfigAndClient(restConfig, httpClient)\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"getting kubernetes client: %w\", err)\n\t\t}\n\n\t\tnodeList, err := k8sClient.CoreV1().Nodes().List(ctx, metav1.ListOptions{})\n\t\tif err != nil {\n\t\t\tfmt.Fprintf(os.Stderr, \"Unable to reach the kubernetes API.\\n\")\n\t\t\tfmt.Fprintf(os.Stderr, \"Use --cloudonly to do a rolling-update without confirming progress with the k8s API\\n\\n\")\n\t\t\treturn fmt.Errorf(\"error listing nodes in cluster: %v\", err)\n\t\t}","sourceCodeStart":235,"sourceCodeEnd":271,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/cmd/kops/rolling-update_cluster.go#L235-L271","documentation":"RunRollingUpdateCluster builds a Kubernetes client to drain/validate nodes. When rolling-update is not in CloudOnly mode, it first obtains a REST config for the target cluster via f.RESTConfig; failure to construct that config (typically no usable admin kubeconfig/credentials for the cluster) aborts with this wrapped error.","triggerScenarios":"`kops rolling-update cluster` without --cloudonly when the admin kubeconfig is missing, expired, or unreadable: cluster never had kubecfg generated, `kops export kubecfg --admin` not run or expired (admin credentials typically expire after ~15m-18h), wrong KOPS_STATE_STORE so kubeconfig can't be located/refreshed.","commonSituations":"Running rolling-update from a fresh CI machine with no kubeconfig; admin certificate expired after waiting too long between export and update; cluster name mismatch so the wrong kubeconfig context is used; VPC/network changes preventing even config assembly from the state store.","solutions":["Refresh admin credentials: `kops export kubecfg <cluster> --admin` (or `kops get credentials` per version) and retry.","Verify the cluster name/`--name` and KOPS_STATE_STORE match the target cluster.","Ensure the kubeconfig on disk (KUBECONFIG) points to the cluster and is readable.","If you only need cloud-side rebooting and cannot reach the API server, re-run with `--cloudonly` (accepting that node draining is skipped)."],"exampleFix":"# before\nkops rolling-update cluster mycluster.example.com --yes\n// getting rest config: ...\n# after\nkops export kubecfg mycluster.example.com --admin\nkops rolling-update cluster mycluster.example.com --yes","handlingStrategy":"fallback","validationCode":"// Ensure a working admin kubeconfig before rolling update\nif _, err := os.Stat(kubeconfigPath); err != nil {\n    exec.Command(\"kops\", \"export\", \"kubecfg\", clusterName, \"--admin\").Run()\n}","typeGuard":null,"tryCatchPattern":"err := runRollingUpdate(...)\nif err != nil && strings.Contains(err.Error(), \"getting rest config\") {\n    // fall back to cloud-only rolling update (skips drain/validation)\n    log.Printf(\"no API access (%v); retrying with --cloudonly\", err)\n    return runRollingUpdateCloudOnly(...)\n}","preventionTips":["Always run `kops export kubecfg --admin` immediately before rolling-update","Check admin credential expiry windows (~15m for admin tokens) in runbooks","Pin --name and KOPS_STATE_STORE to avoid wrong-cluster kubeconfig","In CI, generate the kubeconfig as a pre-step rather than reusing cached ones"],"tags":["kops","rolling-update","kubeconfig","authentication"],"backgroundTag":"kubeconfig-missing-or-expired","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T12:17:11.808Z"}