kubernetes/kops · critical

building controller clientset: %w

Error message

building controller clientset: %w

What it means

NewServer constructs the controller clientset tying together VFS context, configBase, cluster name, keystore and secret store. A failure here (wrapped with this message) means the server cannot be initialized because the clientset could not be built.

Source

Thrown at cmd/kops-controller/pkg/server/server.go:112

	if err != nil {
		return nil, fmt.Errorf("cannot parse ConfigBase %q: %w", opt.ConfigBase, err)
	}
	s.configBase = configBase

	s.keystore, s.keypairIDs, err = newKeystore(opt.Server.CABasePath, opt.Server.SigningCAs)
	if err != nil {
		return nil, err
	}

	p, err := vfsContext.BuildVfsPath(opt.SecretStore)
	if err != nil {
		return nil, fmt.Errorf("cannot parse SecretStore %q: %w", opt.SecretStore, err)
	}
	s.secretStore = secrets.NewVFSSecretStore(nil, p)

	clientset, err := controllerclientset.New(vfsContext, configBase, opt.ClusterName, s.keystore, s.secretStore)
	if err != nil {
		return nil, fmt.Errorf("building controller clientset: %w", err)
	}
	s.clientset = clientset

	challengeClient, err := bootstrap.NewChallengeClient(s.keystore)
	if err != nil {
		return nil, err
	}
	s.challengeClient = challengeClient

	r := http.NewServeMux()
	r.Handle("/healthz", http.HandlerFunc(healthCheck))
	r.Handle("/bootstrap", http.HandlerFunc(s.bootstrap))
	server.Handler = recovery(r)

	return s, nil
}

func (s *Server) GetClientset() simple.Clientset {

View on GitHub (pinned to 4c8573c808)

Solutions

1. Read the wrapped error from controllerclientset.New
2. Verify --cluster-name matches the state at --config-base
3. Ensure keystore and secretStore initialized successfully earlier in NewServer
4. Check kops-controller version vs cluster state version

// ensure prior dependencies parsed
if configBase == nil || s.keystore == nil || s.secretStore == nil {
    return nil, fmt.Errorf("clientset dependencies not initialized")
}

clientset, err := controllerclientset.New(vfsContext, configBase, opt.ClusterName, s.keystore, s.secretStore)
if err != nil {
    return nil, fmt.Errorf("building controller clientset: %w", err)
}

When it happens

Trigger: controllerclientset.New returns an error, typically due to inconsistent configuration (nil keystore/secretstore, bad cluster name, earlier vfs setup problems).

Common situations: Internal inconsistency after misconfigured flags (bad ConfigBase/SecretStore/cluster name); nil or partially initialized stores passed in; version mismatch in clientset factory expectations.

Related errors

• building nodeConfig for instanceGroup: %w
• cannot parse ConfigBase %q: %w
• no keypair ID for %q
• error building kube-controller-manager flags: %v
• error building kube-proxy manifest: %v

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/d029ff1db334581b. Report an issue: GitHub.