kubernetes/kops · error

error building ConfigBase for cluster: %v

Error message

error building ConfigBase for cluster: %v

What it means

After setting the config store, NewCluster calls clientset.ConfigBaseFor(cluster) to resolve the VFS path where the cluster's configuration will be stored. If that resolution fails (bad state store URL, unsupported scheme, backend errors), the error is wrapped as 'error building ConfigBase for cluster'.

Source

Thrown at upup/pkg/fi/cloudup/new_cluster.go:261

			cluster.Spec.KubernetesVersion = kubernetesVersion.String()
		}
	} else {
		cluster.Spec.KubernetesVersion = opt.KubernetesVersion
	}

	// Verify the kubernetes version early (while we can still handle the version nicely)
	if cluster.Spec.KubernetesVersion != "" {
		if _, err := util.ParseKubernetesVersion(cluster.Spec.KubernetesVersion); err != nil {
			return nil, fmt.Errorf("cannot parse KubernetesVersion %q: %w", cluster.Spec.KubernetesVersion, err)
		}
	}

	cluster.Spec.ConfigStore = api.ConfigStoreSpec{
		Base: opt.ConfigBase,
	}
	configBase, err := clientset.ConfigBaseFor(cluster)
	if err != nil {
		return nil, fmt.Errorf("error building ConfigBase for cluster: %v", err)
	}
	cluster.Spec.ConfigStore.Base = configBase.Path()

	cluster.Spec.Authorization = &api.AuthorizationSpec{}
	if strings.EqualFold(opt.Authorization, AuthorizationFlagAlwaysAllow) {
		cluster.Spec.Authorization.AlwaysAllow = &api.AlwaysAllowAuthorizationSpec{}
	} else if opt.Authorization == "" || strings.EqualFold(opt.Authorization, AuthorizationFlagRBAC) {
		cluster.Spec.Authorization.RBAC = &api.RBACAuthorizationSpec{}
	} else {
		return nil, fmt.Errorf("unknown authorization mode %q", opt.Authorization)
	}

	cluster.Spec.IAM = &api.IAMSpec{
		AllowContainerRegistry: true,
	}
	cluster.Spec.Kubelet = &api.KubeletConfigSpec{
		AnonymousAuth: new(false),
	}

View on GitHub (pinned to 4c8573c808)

Solutions

1. Fix the --state flag / opt.ConfigBase to a valid store path, e.g. --state s3://my-kops-state-bucket
2. Create the S3 bucket (or equivalent) and verify credentials with the cloud CLI
3. Read the wrapped %v error for the concrete backend failure

Example fix

// before
kops create cluster --state s3://nonexistent-bucket --name c.example.com
// after
kops create cluster --state s3://my-existing-kops-bucket --name c.example.com

// Ensure --state is a well-formed, reachable store first:
// e.g. verify s3://bucket exists and credentials work via the cloud CLI.

result, err := NewCluster(opt, cs)
if err != nil {
    if strings.Contains(err.Error(), "error building ConfigBase") {
        // inspect wrapped cause: fix --state path or credentials
    }
    return err
}

When it happens

Trigger: `kops create cluster` with an invalid --state value (e.g. unreachable S3 bucket, malformed vfs:// or gs:// path), or permissions preventing the backend from being accessed during path construction.

Common situations: Typo in --state s3://bucket name; bucket not existing yet or in another region/account; using a scheme the VFS layer does not recognize; expired cloud credentials.

Related errors

• expected azureblob:// ConfigStore.Base for Azure cluster, go
• error parsing ConfigStore.Base %q: %v
• error reading full cluster spec for %q: %v
• parsing path for kops-channels manifest %s: %w
• reading kops-channels manifest %s: %w

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/2ad4cccf770bc6cc. Report an issue: GitHub.