{"record":{"id":"e7ebd56eb164e8b4","repo":"kubernetes/kops","slug":"error-building-kube-controller-manager-flags-v","errorCode":null,"errorMessage":"error building kube-controller-manager flags: %v","messagePattern":"error building kube-controller-manager flags: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"nodeup/pkg/model/kube_controller_manager.go","lineNumber":151,"sourceCode":"\t\terr := issueCert.AddFileTasks(c, pathSrvKCM, \"server\", \"\", nil)\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\n\t\tkcm.TLSCertFile = new(filepath.Join(pathSrvKCM, \"server.crt\"))\n\t\tkcm.TLSPrivateKeyFile = filepath.Join(pathSrvKCM, \"server.key\")\n\t}\n\n\treturn nil\n}\n\n// buildPod is responsible for building the kubernetes manifest for the controller-manager\nfunc (b *KubeControllerManagerBuilder) buildPod(kcm *kops.KubeControllerManagerConfig) (*v1.Pod, error) {\n\tpathSrvKCM := filepath.Join(b.PathSrvKubernetes(), \"kube-controller-manager\")\n\n\tflags, err := flagbuilder.BuildFlagsList(kcm)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"error building kube-controller-manager flags: %v\", err)\n\t}\n\n\t// Add kubeconfig flags\n\tfor _, flag := range []string{\"\", \"authentication-\", \"authorization-\"} {\n\t\tflags = append(flags, \"--\"+flag+\"kubeconfig=\"+\"/var/lib/kube-controller-manager/kubeconfig\")\n\t}\n\n\t// Configure CA certificate to be used to sign keys\n\tflags = append(flags, []string{\n\t\t\"--cluster-signing-cert-file=\" + filepath.Join(pathSrvKCM, \"ca.crt\"),\n\t\t\"--cluster-signing-key-file=\" + filepath.Join(pathSrvKCM, \"ca.key\"),\n\t}...)\n\n\tpod := &v1.Pod{\n\t\tTypeMeta: metav1.TypeMeta{\n\t\t\tAPIVersion: \"v1\",\n\t\t\tKind:       \"Pod\",\n\t\t},","sourceCodeStart":133,"sourceCodeEnd":169,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/nodeup/pkg/model/kube_controller_manager.go#L133-L169","documentation":"KubeControllerManagerBuilder.buildPod constructs the kube-controller-manager static pod. It calls flagbuilder.BuildFlagsList(kcm) to turn the KubeControllerManagerConfig struct into CLI flags; any failure there is wrapped as 'error building kube-controller-manager flags'. It means the flag builder rejected the controller-manager configuration.","triggerScenarios":"flagbuilder.BuildFlagsList(kcm) errors, which happens when a configured field value cannot be rendered as a flag string — e.g. a field of unsupported type for the flag builder, or a custom Validate hook returning an error for a config value.","commonSituations":"Invalid values in the cluster spec's kubeControllerManager section (e.g. malformed map/slice-typed flags, bad cloudProvider or feature-gate syntax); schema changes after kops upgrade leaving stale fields in the cluster spec; hand-edited cluster YAML.","solutions":["Read the wrapped %v detail for the specific flag/value that failed","Fix the offending value in the cluster spec under spec.kubeControllerManager (kops edit cluster)","Re-validate with `kops validate cluster` / re-run `kops update cluster`","If a kops upgrade introduced it, check release notes for removed/renamed kubeControllerManager flags"],"exampleFix":"// before (cluster spec)\nkubeControllerManager:\n  featureGates: \"Foo=true,Bar\"\n// after\nkubeControllerManager:\n  featureGates: \"Foo=true,Bar=true\"","handlingStrategy":"validation","validationCode":"if kcm == nil {\n    return fmt.Errorf(\"KubeControllerManagerConfig is nil\")\n}\nif kcm.CloudProvider == \"\" {\n    return fmt.Errorf(\"kubeControllerManager.cloudProvider must be set\")\n}","typeGuard":"func isFlagBuildErr(err error) bool {\n    return err != nil && strings.Contains(err.Error(), \"error building kube-controller-manager flags\")\n}","tryCatchPattern":"flags, err := flagbuilder.BuildFlagsList(kcm)\nif err != nil {\n    return nil, fmt.Errorf(\"error building kube-controller-manager flags: %v\", err)\n}\n// caller: inspect wrapped detail, correct the spec field named in the message","preventionTips":["Validate spec.kubeControllerManager values with `kops validate cluster` before update","Use kops-supported flag names only; check release notes after upgrades","Avoid free-form strings for typed flags (use featureGates maps when available)","Round-trip test: `kops get cluster -o yaml` then diff after edits"],"tags":["go","kubernetes","nodeup","flagbuilder","config"],"backgroundTag":"flag-building-failed","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T07:17:12.445Z"}