kubernetes/kops · error

creating aws IPAM controller: %w

Error message

creating aws IPAM controller: %w

What it means

kops-controller failed while constructing the AWS IPAM reconciler, the controller-runtime component that allocates and attaches VPC IPAM addresses for nodes on AWS. NewAWSIPAMReconciler returned a non-nil error, and setupCloudIPAM wraps it with this message so the root cause (e.g. cloud client or config construction failure) is preserved via %w. The process exits before the manager starts any controllers.

Source

Thrown at cmd/kops-controller/main.go:406

		return err
	}

	return nil
}

// Reconciler is the interface for a standard Reconciler.
type Reconciler interface {
	SetupWithManager(mgr manager.Manager) error
}

func setupCloudIPAM(ctx context.Context, mgr manager.Manager, opt *config.Options) error {
	setupLog.Info("enabling IPAM controller")
	var controller Reconciler
	switch opt.Cloud {
	case "aws":
		ipamController, err := controllers.NewAWSIPAMReconciler(ctx, mgr)
		if err != nil {
			return fmt.Errorf("creating aws IPAM controller: %w", err)
		}
		controller = ipamController
	case "gce":
		ipamController, err := controllers.NewGCEIPAMReconciler(mgr)
		if err != nil {
			return fmt.Errorf("creating gce IPAM controller: %w", err)
		}
		controller = ipamController
	case "metal":
		ipamController, err := controllers.NewMetalIPAMReconciler(ctx, mgr)
		if err != nil {
			return fmt.Errorf("creating metal IPAM controller: %w", err)
		}
		controller = ipamController
	default:
		return fmt.Errorf("kOps IPAM controller is not supported on cloud %q", opt.Cloud)
	}

View on GitHub (pinned to 4c8573c808)

Solutions

1. Inspect the wrapped cause (%w) in the controller log to see why NewAWSIPAMReconciler failed
2. Verify AWS credentials and region are available to kops-controller (env vars, IRSA, instance profile)
3. Confirm --cloud=aws is intended and the IPAM feature flag is correct; disable IPAM controller if not needed
4. Rebuild/redeploy kops-controller matching the cluster version

Example fix

// before
ipamController, err := controllers.NewAWSIPAMReconciler(ctx, mgr)
if err != nil {
	return fmt.Errorf("creating aws IPAM controller: %w", err)
}
// after: surface and gate on cause
ipamController, err := controllers.NewAWSIPAMReconciler(ctx, mgr)
if err != nil {
	setupLog.Error(err, "aws IPAM controller creation failed; check cloud credentials/config")
	return fmt.Errorf("creating aws IPAM controller: %w", err)
}

// before enabling the IPAM controller on aws
if opt.Cloud != "aws" {
	return fmt.Errorf("IPAM controller requires --cloud=aws, got %q", opt.Cloud)
}
// verify AWS config is reachable
if _, err := config.LoadDefaultConfig(ctx); err != nil {
	return fmt.Errorf("AWS credentials unavailable: %w", err)
}

// Go: check wrapped error at startup
if err := setupCloudIPAM(ctx, controllers, mgr, opt); err != nil {
	var fatalErr error
	if errors.As(err, &fatalErr) {
		setupLog.Error(err, "IPAM controller setup failed")
	}
	os.Exit(1)
}

When it happens

Trigger: controllers.NewAWSIPAMReconciler(ctx, mgr) returns err; invoked only when --cloud=aws and the IPAM controller is enabled in kops-controller startup.

Common situations: Misconfigured AWS credentials or region when building the cloud client; failure creating the EC2/AWS SDK client; incompatible manager options passed in; regression after kops version upgrade.

Related errors

• creating gce IPAM controller: %w
• creating metal IPAM controller: %w
• registering IPAM controller: %w
• error building node identifier: %w
• kOps IPAM controller is not supported on cloud %q

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/218263977bc4204f. Report an issue: GitHub.