{"record":{"id":"f6728d6d8ac37b08","repo":"kubernetes/kubernetes","slug":"error-creating-serviceaccount-controller-w","errorCode":null,"errorMessage":"error creating ServiceAccount controller: %w","messagePattern":"error creating ServiceAccount controller: %w","errorType":"console","errorClass":null,"httpStatus":null,"severity":"critical","filePath":"cmd/kube-controller-manager/app/core.go","lineNumber":592,"sourceCode":"\t}\n}\n\nfunc newServiceAccountController(ctx context.Context, controllerContext ControllerContext, controllerName string) (Controller, error) {\n\tclient, err := controllerContext.NewClient(\"service-account-controller\")\n\tif err != nil {\n\t\treturn nil, err\n\t}\n\tlogger := klog.FromContext(ctx)\n\n\tsac, err := serviceaccountcontroller.NewServiceAccountsController(\n\t\tlogger,\n\t\tcontrollerContext.InformerFactory.Core().V1().ServiceAccounts(),\n\t\tcontrollerContext.InformerFactory.Core().V1().Namespaces(),\n\t\tclient,\n\t\tserviceaccountcontroller.DefaultServiceAccountsControllerOptions(),\n\t)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"error creating ServiceAccount controller: %w\", err)\n\t}\n\n\treturn newControllerLoop(func(ctx context.Context) {\n\t\tsac.Run(ctx, 1)\n\t}, controllerName), nil\n}\n\nfunc newTTLControllerDescriptor() *ControllerDescriptor {\n\treturn &ControllerDescriptor{\n\t\tname:        names.TTLController,\n\t\taliases:     []string{\"ttl\"},\n\t\tconstructor: newTTLController,\n\t}\n}\n\nfunc newTTLController(ctx context.Context, controllerContext ControllerContext, controllerName string) (Controller, error) {\n\tclient, err := controllerContext.NewClient(\"ttl-controller\")\n\tif err != nil {","sourceCodeStart":574,"sourceCodeEnd":610,"githubUrl":"https://github.com/kubernetes/kubernetes/blob/b882c60b4023bdf09264c2d5d30a2cadebc240fb/cmd/kube-controller-manager/app/core.go#L574-L610","documentation":"Returned by newServiceAccountController when serviceaccountcontroller.NewServiceAccountsController fails (core.go:584-592). The constructor validates its ServiceAccount/Namespace informers and client options; nil informers or a nil client are the usual cause. The %w is the constructor error.","triggerScenarios":"KCM startup reaching the SA controller with a nil ServiceAccount or Namespace informer, or with DefaultServiceAccountsControllerOptions containing an invalid value. Stock builds always wire these informers.","commonSituations":"Custom KCM build missing informer init; disabling the namespace informer while the SA controller is enabled; providing incompatible options via a patched DefaultServiceAccountsControllerOptions.","solutions":["Inspect %w for the named nil/invalid argument","Ensure Core().V1().ServiceAccounts() and Namespaces() informers are initialized","Rebuild from unmodified sources","If SA token automation is unwanted, disable via --controllers=-serviceaccount"],"exampleFix":"// before: custom build passing nil SA informer\n// after:\n//   serviceaccountcontroller.NewServiceAccountsController(logger,\n//     informerFactory.Core().V1().ServiceAccounts(),\n//     informerFactory.Core().V1().Namespaces(), client, opts)","handlingStrategy":"type-guard","validationCode":"if client == nil || saInformer == nil || nsInformer == nil {\n    return errors.New(\"nil client or informer for SA controller\")\n}","typeGuard":"func hasSynced(i cache.SharedIndexInformer) bool { return i != nil && i.HasSynced() }","tryCatchPattern":"null","preventionTips":["Never disable the namespace informer while the SA controller is enabled","If SA automation is unwanted, disable via --controllers=-serviceaccount rather than nil-wiring"],"tags":["kubernetes","kube-controller-manager","service-account","rbac","startup"],"analyzedSha":"b882c60b4023bdf09264c2d5d30a2cadebc240fb","analyzedAt":"2026-08-07T04:07:48.144Z","schemaVersion":2},"datasetVersion":"2026-08-07T07:17:06.508Z"}