kubernetes/kops · error

building bootstrap data: %w

Error message

building bootstrap data: %w

What it means

Thrown by buildBootstrapData when commands.ConfigBuilder.GetBootstrapData fails to render node bootstrap (nodeup) configuration for the placeholder node InstanceGroup (pkg/controllers/clusterapi/kopsconfig_controller.go:221-223). GetBootstrapData assembles the full nodeup config — cluster spec, instance group, cloud, well-known addresses and base64-encoded assets — so almost any inconsistency in these inputs or failure to fetch kops assets causes this wrap.

Source

Thrown at pkg/controllers/clusterapi/kopsconfig_controller.go:223

		// The machine image is chosen by the CAPI infrastructure provider and is not used for
		// nodeup config generation; the placeholder avoids resolving a default from the channel.
		ig.Spec.Image = "placeholder-image"

		configBuilder.InstanceGroup = ig
		configBuilder.InstanceGroupName = ig.Name
	}

	{
		cloud, err := cloudup.BuildCloud(clusterInternal)
		if err != nil {
			return nil, fmt.Errorf("building cloud: %w", err)
		}
		configBuilder.Cloud = cloud
	}

	bootstrapData, err := configBuilder.GetBootstrapData(ctx)
	if err != nil {
		return nil, fmt.Errorf("building bootstrap data: %w", err)
	}

	return bootstrapData.NodeupScript, nil
}

View on GitHub (pinned to 4c8573c808)

Solutions

1. Read the wrapped error to find the concrete failure (asset fetch, config validation, VFS access, etc.).
2. Verify KopsControlPlane status.systemEndpoints contains kubeAPIServer and kopsController endpoints before this reconcile proceeds — if empty, the control plane is not ready and reconciliation will retry.
3. Check that the controller pod has valid credentials and network access to the kops state store (e.g. S3 bucket for AWS).
4. Ensure the kops controller binary version matches the cluster's kopsVersion so nodeup assets resolve correctly.
5. If the cluster spec is inconsistent, re-apply a kops-validated Cluster spec and let the reconciler retry.

Example fix

// before: controller SA lacks state-store access (no AWS creds)
// error: building bootstrap data: error reading nodeup asset
// after: bind IRSA role to controller service account
metadata:
  annotations:
    eks.amazonaws.com/role-arn: arn:aws:iam::123456789012:role/kops-controller

// Pre-check that KopsControlPlane has the endpoints GetBootstrapData depends on
if len(kopsControlPlane.Status.SystemEndpoints) == 0 {
	return fmt.Errorf("KopsControlPlane %s/%s has no systemEndpoints yet; control plane not ready", kopsControlPlane.Namespace, kopsControlPlane.Name)
}
// Pre-check state-store reachability from the controller
// e.g. attempt a lightweight clientset list before generating bootstrap data

data, err := r.buildBootstrapData(ctx, cluster, kopsControlPlane)
if err != nil {
	// Most causes are transient (endpoints not ready, VFS blips) — requeue with backoff
	return ctrl.Result{RequeueAfter: 30 * time.Second}, fmt.Errorf("building bootstrap data: %w", err)
}

When it happens

Trigger: GetBootstrapData fails because the kops clientset (r.clientset) cannot reach the state store / VFS to fetch assets or config, well-known service addresses are missing/invalid from KopsControlPlane status, the cluster spec is internally inconsistent (mismatched kubelet versions, invalid networking), or nodeup/asset resolution fails.

Common situations: KopsControlPlane status has not yet populated SystemEndpoints so required well-known addresses are empty; the kops state store (S3 bucket etc.) is unreachable or credentials are missing from the controller; cluster spec fields reference assets that don't exist; a kops version mismatch producing incompatible nodeup config.

Related errors

• error loading NodeupConfig %q: %v
• building cloud: %w
• node identity is required
• did not find owner for node %q
• invalid InstanceGroup name: %v

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/8884d8bb9640dca4. Report an issue: GitHub.