kubernetes/kops · error

error building kube-proxy manifest: %v

Error message

error building kube-proxy manifest: %v

What it means

KubeProxyBuilder.Build creates the kube-proxy static pod manifest. It first calls b.buildPod(); if that fails the error is wrapped as 'error building kube-proxy manifest'. This is a wrapper around any failure constructing the kube-proxy pod spec — most commonly the KubeProxy config being missing (see the 'KubeProxy not configured' error).

Source

Thrown at nodeup/pkg/model/kube_proxy.go:51

// KubeProxyBuilder installs kube-proxy
type KubeProxyBuilder struct {
	*NodeupModelContext
}

var _ fi.NodeupModelBuilder = &KubeProxyBuilder{}

// Build is responsible for building the kube-proxy manifest
// @TODO we should probably change this to a daemonset in the future and follow the kubeadm path
func (b *KubeProxyBuilder) Build(c *fi.NodeupModelBuilderContext) error {
	if b.NodeupConfig.KubeProxy == nil {
		klog.V(2).Infof("Kube-proxy is disabled, will not create configuration for it.")
		return nil
	}

	{
		pod, err := b.buildPod()
		if err != nil {
			return fmt.Errorf("error building kube-proxy manifest: %v", err)
		}

		pod.ObjectMeta.Labels["kubernetes.io/managed-by"] = "nodeup"

		manifest, err := k8scodecs.ToVersionedYaml(pod)
		if err != nil {
			return fmt.Errorf("error marshaling manifest to yaml: %v", err)
		}

		c.AddTask(&nodetasks.File{
			Path:     "/etc/kubernetes/manifests/kube-proxy.manifest",
			Contents: fi.NewBytesResource(manifest),
			Type:     nodetasks.FileType_File,
		})
	}

	{
		var kubeconfig fi.Resource

View on GitHub (pinned to 4c8573c808)

Solutions

1. Re-run `kops update cluster --yes` and `kops rolling-update cluster` so nodeup and its config are regenerated from the current cluster spec
2. Check the NodeupConfig passed to nodeup contains a non-nil kubeProxy section
3. Ensure the nodeup binary version matches the kops version that produced the config
4. Inspect the wrapped %v detail to see the underlying buildPod error

Example fix

// before (stale nodeup on the node)
ssh node 'sudo nodeup --config=/etc/kubernetes/nodeup.json'
// after
kops update cluster --yes
kops rolling-update cluster --yes   # re-pushes matching nodeup + NodeupConfig

if b.NodeupConfig == nil || b.NodeupConfig.KubeProxy == nil {
    return fmt.Errorf("kube-proxy section missing from NodeupConfig")
}

func isKubeProxyBuildErr(err error) bool {
    return err != nil && strings.Contains(err.Error(), "error building kube-proxy manifest")
}

if err := b.Build(c, ...); err != nil {
    if isKubeProxyBuildErr(err) {
        log.Printf("kube-proxy pod build failed: %v", err) // inspect wrapped cause
    }
    return err
}

When it happens

Trigger: b.buildPod() returns an error during kops update / nodeup execution on a node, which is then wrapped and propagated out of Build. buildPod fails when b.NodeupConfig.KubeProxy is nil, or when subsequent flag/iptables-nftables setup fails.

Common situations: Nodeup config (kube-environment or nodeup config file) generated without a kubeProxy section — e.g. outdated nodeup running against a newer cluster config; corrupted or truncated NodeupConfig; cluster specs where kubeProxy was removed inadvertently.

Related errors

• error building kube-controller-manager flags: %v
• error marshaling manifest to yaml: %v
• KubeProxy not configured
• building nodeConfig for instanceGroup: %w
• no keypair ID for %q

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/2e9eb080f1360794. Report an issue: GitHub.