{"record":{"id":"e7aaf41d4afa28be","repo":"kubernetes/kops","slug":"getting-http-client-w-e7aaf4","errorCode":null,"errorMessage":"getting http client: %w","messagePattern":"getting http client: %w","errorType":"console","errorClass":null,"httpStatus":null,"severity":"error","filePath":"cmd/kops/delete_instance.go","lineNumber":182,"sourceCode":"\t\treturn err\n\t}\n\n\tcluster, err := GetCluster(ctx, f, options.ClusterName)\n\tif err != nil {\n\t\treturn err\n\t}\n\n\tvar k8sClient kubernetes.Interface\n\tvar restConfig *rest.Config\n\tif !options.CloudOnly {\n\t\trestConfig, err = f.RESTConfig(ctx, cluster, options.CreateKubecfgOptions)\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"getting rest config: %w\", err)\n\t\t}\n\n\t\thttpClient, err := f.HTTPClient(restConfig)\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"getting http client: %w\", err)\n\t\t}\n\n\t\tk8sClient, err = kubernetes.NewForConfigAndClient(restConfig, httpClient)\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"cannot build kube client: %w\", err)\n\t\t}\n\t}\n\n\tvar nodes []v1.Node\n\tif !options.CloudOnly {\n\t\tnodes, err = getNodes(ctx, k8sClient, true)\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t}\n\n\tlist, err := clientSet.InstanceGroupsFor(cluster).List(ctx, metav1.ListOptions{})\n\tif err != nil {","sourceCodeStart":164,"sourceCodeEnd":200,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/cmd/kops/delete_instance.go#L164-L200","documentation":"After obtaining the REST config, RunDeleteInstance builds an HTTP client via f.HTTPClient(restConfig) for the Kubernetes client. Any failure constructing this client (typically TLS material problems: bad CA data, malformed cert/key in the rest config) is wrapped with this message.","triggerScenarios":"f.HTTPClient fails because the rest.Config carries invalid TLS settings — corrupt or unreadable CA/certificate files referenced by the kubeconfig, or unsupported proxy/transport configuration.","commonSituations":"Kubeconfig generated with truncated or rotated CA data; cert files moved/deleted after kubeconfig creation; expired client certificates producing transport setup issues.","solutions":["Re-export a fresh kubeconfig: `kops export kubeconfig <cluster> --admin`.","Inspect the kubeconfig's certificate-authority-data / client-certificate paths and confirm the files exist and are valid PEM.","If TLS setup is irreparable, use `--cloud-only` to avoid building the Kubernetes client."],"exampleFix":"// before (kubeconfig)\nclient-certificate: /home/user/.kube/old-cert.pem  # deleted\n// after\nkops export kubeconfig cluster.example.com --admin  # regenerates valid TLS material","handlingStrategy":"try-catch","validationCode":"cfg, err := clientcmd.NewNonInteractiveDeferredLoadingClientConfig(\n    clientcmd.NewDefaultClientConfigLoadingRules(), nil).ClientConfig()\nif err != nil {\n    return err\n}\nif cfg.CAData == nil && cfg.CAFile == \"\" {\n    return fmt.Errorf(\"kubeconfig lacks CA data; re-export with kops export kubeconfig\")\n}","typeGuard":null,"tryCatchPattern":"if err := run(...); err != nil && strings.Contains(err.Error(), \"getting http client\") {\n    // TLS material is invalid: regenerate kubeconfig and retry\n}","preventionTips":["Re-export kubeconfig after CA rotation.","Do not hand-edit certificate-authority-data or cert paths.","Validate kubeconfig TLS files load as PEM before running delete."],"tags":["kubernetes","tls","api-client"],"backgroundTag":"tls-client-setup-failed","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T07:17:12.445Z"}