kubernetes/kops · error

cannot build kube client for %q: %w

Error message

cannot build kube client for %q: %w

What it means

kops wraps the error from kubernetes.NewForConfig(config) when a REST config was successfully loaded from the kubeconfig but a Kubernetes clientset could not be constructed from it. This is rarer than the config-load failure and typically indicates invalid REST config content (e.g. malformed host URL, unsupported/unparseable auth scheme, invalid certificate data in the context's user entry).

Source

Thrown at cmd/kops/delete_instance.go:404

	}
}

// getKubeClientFromKubeconfig returns a kubernetes client from the kubeconfig,
// assuming it has already been exported.  This is not ideal, but is reasonable
// for command completion.
func getKubeClientFromKubeconfig(ctx context.Context, cluster *kopsapi.Cluster) (kubernetes.Interface, error) {
	contextName := cluster.ObjectMeta.Name
	clientGetter := genericclioptions.NewConfigFlags(true)
	clientGetter.Context = &contextName

	config, err := clientGetter.ToRESTConfig()
	if err != nil {
		return nil, fmt.Errorf("cannot load kubecfg settings for %q: %w", contextName, err)
	}

	k8sClient, err := kubernetes.NewForConfig(config)
	if err != nil {
		return nil, fmt.Errorf("cannot build kube client for %q: %w", contextName, err)
	}
	return k8sClient, nil
}

func appendInstance(completions []string, instance *cloudinstances.CloudInstance, longestGroup int) []string {
	completion := instance.ID
	if instance.CloudInstanceGroup.InstanceGroup != nil {
		completion += "\t" + instance.CloudInstanceGroup.InstanceGroup.Name

		if instance.Node != nil {
			padding := strings.Repeat(" ", longestGroup+1-len(instance.CloudInstanceGroup.InstanceGroup.Name))
			completion += padding + instance.Node.Name
			completions = append(completions, instance.Node.Name+"\t"+instance.CloudInstanceGroup.InstanceGroup.Name+padding+instance.ID)
		}
	}
	return append(completions, completion)
}

View on GitHub (pinned to 4c8573c808)

Solutions

1. Inspect the wrapped error: it names the invalid field (host URL, cert data, auth plugin). Fix that field in the kubeconfig.
2. Re-export a fresh kubeconfig: `kops export kubecfg <cluster-name>` to regenerate valid certificate/host data.
3. Validate the file with `kubectl config view --raw` and try `kubectl --context <cluster-name> get nodes` to confirm the config works outside kops.
4. Reinstall or fix the exec credential plugin referenced by the context's user.

Example fix

// before (hand-edited kubeconfig)
server: prod.example.com  # missing scheme -> NewForConfig fails
// after
server: https://api.prod.example.com

kubectl config view --raw --context "$CLUSTER" >/dev/null && kubectl --context "$CLUSTER" get --raw /healthz >/dev/null || echo "invalid kubeconfig for $CLUSTER"

When it happens

Trigger: Calling getKubeClientFromKubeconfig with a kubeconfig whose context has a malformed server URL (missing scheme), corrupt certificate/base64 data, an exec auth plugin that fails config validation, or an otherwise invalid config for client-go's clientset constructor.

Common situations: Hand-edited ~/.kube/config with a typo'd server URL or broken certificate; kops export produced credentials for a CA that has been rotated/replaced; exec credential plugin (aws eks get-token etc.) not installed or misconfigured; version mismatch between kubeconfig fields and the client-go version.

Related errors

• cannot build kube client: %w
• cannot load kubecfg settings for %q: %w
• building kubernetes client: %w
• building kubernetes client for node labeler: %w
• building kube client: %w

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/afd64fe14f071650. Report an issue: GitHub.