kubernetes/kops · error

error building corev1 client: %v

Error message

error building corev1 client: %v

What it means

NewAWSIPAMReconciler builds a typed client-go CoreV1Client from the controller-runtime manager's rest.Config via corev1client.NewForConfig. This error is returned when that client construction fails, with the underlying cause embedded via %v. It almost always indicates an invalid REST configuration rather than a connectivity problem.

Source

Thrown at cmd/kops-controller/controllers/awsipam.go:54

	corev1client "k8s.io/client-go/kubernetes/typed/core/v1"
	"k8s.io/klog/v2"
	"k8s.io/kops/util/pkg/awslog"
	ctrl "sigs.k8s.io/controller-runtime"
	"sigs.k8s.io/controller-runtime/pkg/client"
	"sigs.k8s.io/controller-runtime/pkg/manager"
)

// NewAWSIPAMReconciler is the constructor for a IPAMReconciler
func NewAWSIPAMReconciler(ctx context.Context, mgr manager.Manager) (*AWSIPAMReconciler, error) {
	klog.Info("Starting aws ipam controller")
	r := &AWSIPAMReconciler{
		client: mgr.GetClient(),
		log:    ctrl.Log.WithName("controllers").WithName("IPAM"),
	}

	coreClient, err := corev1client.NewForConfig(mgr.GetConfig())
	if err != nil {
		return nil, fmt.Errorf("error building corev1 client: %v", err)
	}
	r.coreV1Client = coreClient

	config, err := awsconfig.LoadDefaultConfig(ctx, awslog.WithAWSLogger())
	if err != nil {
		return nil, fmt.Errorf("error loading default AWS config: %v", err)
	}

	metadata := imds.NewFromConfig(config)

	resp, err := metadata.GetRegion(ctx, &imds.GetRegionInput{})
	if err != nil {
		return nil, fmt.Errorf("error querying ec2 metadata service (for region): %v", err)
	}

	ec2Config := config.Copy()
	ec2Config.Region = resp.Region
	r.ec2Client = ec2.NewFromConfig(ec2Config)

View on GitHub (pinned to 4c8573c808)

Solutions

1. Inspect the %v cause after this message — it names the invalid config field (e.g. host must be a URL).
2. When running locally, set KUBECONFIG or pass a valid kubeconfig so the manager's rest.Config has a reachable API server host.
3. Verify the controller is running in-cluster with a mounted service-account token and KUBERNETES_SERVICE_HOST/PORT set.
4. Check that the rest.Config's CA data / bearer token files exist and are readable.

Example fix

// before (local dev, no kubeconfig)
ctrl.NewManager(ctrl.GetConfigOrDie(), ...)
// after
export KUBECONFIG=~/.kube/config
// or in-cluster, ensure the pod has its service account mounted and RBAC for nodes

cfg, err := ctrl.GetConfig()
if err != nil {
    return fmt.Errorf("no usable kube config: %w", err)
}
if cfg.Host == "" {
    return fmt.Errorf("kube config host is empty; set KUBECONFIG or run in-cluster")
}

rec, err := NewAWSIPAMReconciler(ctx, mgr)
if err != nil {
    if strings.Contains(err.Error(), "error building corev1 client") {
        return fmt.Errorf("check kubeconfig / in-cluster service account: %w", err)
    }
    return err
}

When it happens

Trigger: Calling NewAWSIPAMReconciler (from setupCloudIPAM) when mgr.GetConfig() yields a rest.Config that NewForConfig cannot use — e.g. nil/empty host, unparsable API URL, or missing/invalid TLS material.

Common situations: Running kops-controller outside the cluster without a valid kubeconfig; KUBERNETES_SERVICE_HOST/PORT unset so the in-cluster config is broken; a malformed --server flag or corrupted kubeconfig mounted into the controller pod.

Related errors

• cannot build kube client: %w
• cannot load kubecfg settings for %q: %w
• cannot build kube client for %q: %w
• building kubernetes client: %w
• failed to get bootstrap data secret: %w

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/4aee7ae8de28195f. Report an issue: GitHub.