k3s-io/k3s · critical

failed to get CRDs from %s: %v

Error message

failed to get CRDs from %s: %v

What it means

During server startup, k3s collects the CustomResourceDefinitions it must install: the built-in k3s CRD set (k3scrds.List) plus the helm-controller CRDs (helmcrds.List) when the embedded Helm controller is enabled. Each lister reads embedded YAML manifests and parses them into apiextv1 CRD objects; if a lister fails, the wrapped error identifies the failing lister via util.GetFunctionName. This error aborts CRD registration and therefore server bootstrapping.

Source

Thrown at pkg/server/context.go:109

		return nil, err
	}

	return c, nil
}

type crdLister func() ([]*apiextv1.CustomResourceDefinition, error)

func (c *Context) registerCRDs(ctx context.Context) error {
	listers := []crdLister{k3scrds.List}
	if c.Helm != nil {
		listers = append(listers, helmcrds.List)
	}

	crds := []*apiextv1.CustomResourceDefinition{}
	for _, list := range listers {
		l, err := list()
		if err != nil {
			return fmt.Errorf("failed to get CRDs from %s: %v", util.GetFunctionName(list), err)
		}
		crds = append(crds, l...)
	}

	return retry.RetryOnConflict(retry.DefaultRetry, func() error {
		return crd.BatchCreateCRDs(ctx, c.Ext.ApiextensionsV1().CustomResourceDefinitions(), nil, time.Minute, crds)
	})
}

View on GitHub (pinned to 6ba341e396)

Solutions

1. Verify the k3s binary integrity: re-download the exact release from GitHub and compare its sha256 checksum against the published checksums file.
2. If built from source, run the full generate/build targets so embedded CRD assets (k3scrds, helmcrds) are regenerated, then rebuild.
3. Restart the server after replacing the binary to confirm registerCRDs succeeds and CRDs appear via kubectl get crd.
4. If the error persists on an official, checksum-verified binary, capture 'kubectl get crd' output and the full log and open an issue at github.com/k3s-io/k3s.

// In Go code embedding k3s server startup:
if err := ctx.registerCRDs(ctx); err != nil {
    if strings.Contains(err.Error(), "failed to get CRDs from") {
        log.Fatal("embedded CRD assets corrupt - verify binary checksum")
    }
    return err
}

When it happens

Trigger: Server startup calling registerCRDs (pkg/server/context.go) where either k3scrds.List or helmcrds.List returns an error: an embedded YAML manifest is missing from the build, fails to decode into apiextv1.CustomResourceDefinition, or the embedded assets FS cannot be read. It cannot be triggered by user configuration; it indicates the binary's embedded CRD payload is broken or the binary was corrupted/modified.

Common situations: A truncated or bit-flipped k3s binary (partial download, bad transfer over an unstable link), a from-source build where the generated CRD manifests were not embedded (make generate/build skipped), or running an unsupported patched binary. Typically reproduces on every restart of the same node.

Related errors

• unhandled cgroup mode
• toleration with empty key must have operator 'Exists'
• toleration with operator 'Exists' must have an empty value
• no bootstrap data is available to reconcile against
• server node name not set

AI-assisted analysis of k3s-io/k3s@6ba341e396 (2026-08-15). Data as JSON: /api/errors/c14c235f08442384. Report an issue: GitHub.