kubernetes/kops · error

cannot create cluster validator: %v

Error message

cannot create cluster validator: %v

What it means

RunDeleteInstance returns this when validation.NewClusterValidator fails to construct the rolling-update cluster validator used to health-check the cluster after the instance is deleted. NewClusterValidator validates its inputs (cluster, cloud, instance group list, REST config, k8s client) and returns an error if it cannot assemble a working validator.

Source

Thrown at cmd/kops/delete_instance.go:268

		Cloud:             cloud,
		K8sClient:         k8sClient,
		FailOnDrainError:  options.FailOnDrainError,
		FailOnValidate:    options.FailOnValidate,
		CloudOnly:         options.CloudOnly,
		ClusterName:       options.ClusterName,
		PostDrainDelay:    options.PostDrainDelay,
		ValidationTimeout: options.ValidationTimeout,
		ValidateCount:     int(options.ValidateCount),
		// TODO should we expose this to the UI?
		ValidateTickDuration:    30 * time.Second,
		ValidateSuccessDuration: 10 * time.Second,
	}

	var clusterValidator validation.ClusterValidator
	if !options.CloudOnly {
		clusterValidator, err = validation.NewClusterValidator(cluster, cloud, list, nil, nil, 0, restConfig, k8sClient)
		if err != nil {
			return fmt.Errorf("cannot create cluster validator: %v", err)
		}
	}
	d.ClusterValidator = clusterValidator

	return d.UpdateSingleInstance(ctx, cloudMember, options.Surge)
}

func getNodes(ctx context.Context, kubeClient kubernetes.Interface, verbose bool) ([]v1.Node, error) {
	var nodes []v1.Node

	nodeList, err := kubeClient.CoreV1().Nodes().List(ctx, metav1.ListOptions{})
	if err != nil {
		if verbose {
			fmt.Fprintf(os.Stderr, "Unable to reach the kubernetes API.\n")
			fmt.Fprintf(os.Stderr, "Use --cloudonly to do a deletion without confirming progress with the k8s API\n\n")
		}
		return nil, fmt.Errorf("listing nodes in cluster: %v", err)
	}

View on GitHub (pinned to 4c8573c808)

Solutions

1. Inspect the wrapped %v error from NewClusterValidator — it names the specific validation/setup failure.
2. Regenerate credentials with `kops export kubecfg <cluster> --admin` and retry, ruling out bad REST config/k8s client inputs.
3. Verify instance groups are intact: `kops get ig --name <cluster> -oyaml`; fix the state store if entries are missing/corrupt.
4. Confirm the kops binary version matches your cluster spec version (kops upgrade cluster / kops update cluster as needed).
5. If the k8s API is unreachable anyway, use --cloudonly, which skips validator creation.

// ensure inputs to the validator are sound before calling it:
if restConfig == nil || k8sClient == nil {
    return fmt.Errorf("restConfig and k8sClient are required for cluster validation; use --cloudonly to skip")
}
if len(list.Items) == 0 {
    return fmt.Errorf("no instance groups found for cluster %q; state store may be incomplete", cluster.Name)
}

clusterValidator, err := validation.NewClusterValidator(cluster, cloud, list, nil, nil, 0, restConfig, k8sClient)
if err != nil {
    return fmt.Errorf("cannot create cluster validator: %v", err)
}
d.ClusterValidator = clusterValidator

When it happens

Trigger: `kops delete instance` without --cloudonly, after the instance was found and --yes given, where validation.NewClusterValidator(cluster, cloud, list, nil, nil, 0, restConfig, k8sClient) returns a non-nil error — e.g. nil or unusable restConfig/k8sClient, an incomplete instance group list, or an invalid cloud/cluster combination.

Common situations: Corrupt REST config slipping past client creation but failing validator setup; instance group list from the state store missing or partially loaded; a recent kops/client-go version change changing NewClusterValidator requirements; cluster spec in the state store inconsistent with the live cloud (BuildCloud succeeded but validator setup disagrees).

Related errors

• invalid InstanceGroup name: %v
• spec.PublicKey is required
• adding keypair to %q is not supported
• unable to parse YAML %v: %v
• error adding SSH public key: %v

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/cf8bb21988e39750. Report an issue: GitHub.