kubernetes/kops · error

cannot build kube client: %w

Error message

cannot build kube client: %w

What it means

This error is returned by RunDeleteInstance in cmd/kops/delete_instance.go when client-go's kubernetes.NewForConfigAndClient fails to construct a Kubernetes clientset from the REST config and HTTP client built for the target cluster. It wraps the underlying error, which is almost always a malformed or invalid rest.Config (bad host URL, invalid TLS material) rather than a network failure — the client is only constructed, never dialed, at this point.

Source

Thrown at cmd/kops/delete_instance.go:187

		return err
	}

	var k8sClient kubernetes.Interface
	var restConfig *rest.Config
	if !options.CloudOnly {
		restConfig, err = f.RESTConfig(ctx, cluster, options.CreateKubecfgOptions)
		if err != nil {
			return fmt.Errorf("getting rest config: %w", err)
		}

		httpClient, err := f.HTTPClient(restConfig)
		if err != nil {
			return fmt.Errorf("getting http client: %w", err)
		}

		k8sClient, err = kubernetes.NewForConfigAndClient(restConfig, httpClient)
		if err != nil {
			return fmt.Errorf("cannot build kube client: %w", err)
		}
	}

	var nodes []v1.Node
	if !options.CloudOnly {
		nodes, err = getNodes(ctx, k8sClient, true)
		if err != nil {
			return err
		}
	}

	list, err := clientSet.InstanceGroupsFor(cluster).List(ctx, metav1.ListOptions{})
	if err != nil {
		return err
	}

	var instanceGroups []*kopsapi.InstanceGroup
	for i := range list.Items {

View on GitHub (pinned to 4c8573c808)

Solutions

1. Read the wrapped %w error to see which part of the rest.Config client-go rejected (URL, TLS cert/key, or transport).
2. Regenerate the kubeconfig with `kops export kubecfg <cluster> --admin` to replace stale or corrupt credentials and server URL.
3. Verify the cluster's API endpoint in the kops state store (kops get cluster -oyaml, check spec.kubernetesApiAccess and master DNS name) is a valid https URL.
4. Confirm client certificate and key files exist, are unencrypted PEM, and match; re-export if certificates were rotated.
5. As a workaround for an unreachable/misconfigured API server workflow, run with --cloudonly, which skips client construction entirely.

Example fix

// before
restConfig, err = f.RESTConfig(ctx, cluster, options.CreateKubecfgOptions)
...
k8sClient, err = kubernetes.NewForConfigAndClient(restConfig, httpClient)
if err != nil {
    return fmt.Errorf("cannot build kube client: %w", err)
}
// after (cli-side: regenerate config first)
// $ kops export kubecfg mycluster.example.com --admin
// then rerun; or inspect the cause explicitly:
if err != nil {
    return fmt.Errorf("cannot build kube client (check kubeconfig/TLS material): %w", err)
}

cfg, err := f.RESTConfig(ctx, cluster, options.CreateKubecfgOptions)
if err != nil {
    return err
}
if u, err := url.Parse(cfg.Host); err != nil || u.Scheme == "" || u.Host == "" {
    return fmt.Errorf("invalid API server host in rest config: %q", cfg.Host)
}
if cfg.TLSClientConfig.Insecure == false && len(cfg.TLSClientConfig.CAData) == 0 && cfg.TLSClientConfig.CAFile == "" {
    return fmt.Errorf("rest config has no CA data; re-export kubecfg")
}

k8sClient, err := kubernetes.NewForConfigAndClient(restConfig, httpClient)
if err != nil {
    var uriErr *url.Error
    if errors.As(err, &uriErr) {
        return fmt.Errorf("cannot build kube client (bad host %q): %w", restConfig.Host, err)
    }
    return fmt.Errorf("cannot build kube client (check kubeconfig/TLS): %w", err)
}

When it happens

Trigger: Running `kops delete instance` without --cloudonly when f.RESTConfig(ctx, cluster, options.CreateKubecfgOptions) yields a config that client-go rejects: unparseable server URL, corrupt/invalid client certificate or key data, unsupported TLS configuration, or an invalid transport setting passed to f.HTTPClient.

Common situations: Stale or hand-edited kubeconfig entries for the cluster; a kops state-store cluster spec with a bad kubeAPI server URL; certificates rotated or expired so the embedded cert/key pair no longer parses; a corporate proxy or custom CA setting producing an invalid HTTP client; version mismatch between client-go and the generated config.

Related errors

• building kubernetes client: %w
• building kube client: %w
• cannot load kubecfg settings for %q: %w
• cannot build kube client for %q: %w
• getting kubernetes client: %w

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/2bdf7e4447ea62b3. Report an issue: GitHub.