kubernetes/kops · error

error building kube-controller-manager flags: %v

Error message

error building kube-controller-manager flags: %v

What it means

KubeControllerManagerBuilder.buildPod constructs the kube-controller-manager static pod. It calls flagbuilder.BuildFlagsList(kcm) to turn the KubeControllerManagerConfig struct into CLI flags; any failure there is wrapped as 'error building kube-controller-manager flags'. It means the flag builder rejected the controller-manager configuration.

Source

Thrown at nodeup/pkg/model/kube_controller_manager.go:151

		err := issueCert.AddFileTasks(c, pathSrvKCM, "server", "", nil)
		if err != nil {
			return err
		}

		kcm.TLSCertFile = new(filepath.Join(pathSrvKCM, "server.crt"))
		kcm.TLSPrivateKeyFile = filepath.Join(pathSrvKCM, "server.key")
	}

	return nil
}

// buildPod is responsible for building the kubernetes manifest for the controller-manager
func (b *KubeControllerManagerBuilder) buildPod(kcm *kops.KubeControllerManagerConfig) (*v1.Pod, error) {
	pathSrvKCM := filepath.Join(b.PathSrvKubernetes(), "kube-controller-manager")

	flags, err := flagbuilder.BuildFlagsList(kcm)
	if err != nil {
		return nil, fmt.Errorf("error building kube-controller-manager flags: %v", err)
	}

	// Add kubeconfig flags
	for _, flag := range []string{"", "authentication-", "authorization-"} {
		flags = append(flags, "--"+flag+"kubeconfig="+"/var/lib/kube-controller-manager/kubeconfig")
	}

	// Configure CA certificate to be used to sign keys
	flags = append(flags, []string{
		"--cluster-signing-cert-file=" + filepath.Join(pathSrvKCM, "ca.crt"),
		"--cluster-signing-key-file=" + filepath.Join(pathSrvKCM, "ca.key"),
	}...)

	pod := &v1.Pod{
		TypeMeta: metav1.TypeMeta{
			APIVersion: "v1",
			Kind:       "Pod",
		},

View on GitHub (pinned to 4c8573c808)

Solutions

1. Read the wrapped %v detail for the specific flag/value that failed
2. Fix the offending value in the cluster spec under spec.kubeControllerManager (kops edit cluster)
3. Re-validate with `kops validate cluster` / re-run `kops update cluster`
4. If a kops upgrade introduced it, check release notes for removed/renamed kubeControllerManager flags

Example fix

// before (cluster spec)
kubeControllerManager:
  featureGates: "Foo=true,Bar"
// after
kubeControllerManager:
  featureGates: "Foo=true,Bar=true"

if kcm == nil {
    return fmt.Errorf("KubeControllerManagerConfig is nil")
}
if kcm.CloudProvider == "" {
    return fmt.Errorf("kubeControllerManager.cloudProvider must be set")
}

func isFlagBuildErr(err error) bool {
    return err != nil && strings.Contains(err.Error(), "error building kube-controller-manager flags")
}

flags, err := flagbuilder.BuildFlagsList(kcm)
if err != nil {
    return nil, fmt.Errorf("error building kube-controller-manager flags: %v", err)
}
// caller: inspect wrapped detail, correct the spec field named in the message

When it happens

Trigger: flagbuilder.BuildFlagsList(kcm) errors, which happens when a configured field value cannot be rendered as a flag string — e.g. a field of unsupported type for the flag builder, or a custom Validate hook returning an error for a config value.

Common situations: Invalid values in the cluster spec's kubeControllerManager section (e.g. malformed map/slice-typed flags, bad cloudProvider or feature-gate syntax); schema changes after kops upgrade leaving stale fields in the cluster spec; hand-edited cluster YAML.

Related errors

• error building kube-proxy manifest: %v
• building nodeConfig for instanceGroup: %w
• no keypair ID for %q
• error marshaling pod to yaml: %v
• error marshaling manifest to yaml: %v

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/e7ebd56eb164e8b4. Report an issue: GitHub.