kubernetes/kops · error

error building kube-scheduler flags: %v

Error message

error building kube-scheduler flags: %v

What it means

KubeSchedulerBuilder.buildPod calls flagbuilder.BuildFlagsList(kubeScheduler) to turn KubeSchedulerConfig into kube-scheduler CLI flags; any failure is wrapped as "error building kube-scheduler flags: %v". This is the underlying cause that surfaces (wrapped again) as "error building kube-scheduler pod" at kube_scheduler.go:78.

Source

Thrown at nodeup/pkg/model/kube_scheduler.go:186

		err := issueCert.AddFileTasks(c, pathSrvScheduler, "server", "", nil)
		if err != nil {
			return err
		}

		kubeScheduler.TLSCertFile = new(filepath.Join(pathSrvScheduler, "server.crt"))
		kubeScheduler.TLSPrivateKeyFile = filepath.Join(pathSrvScheduler, "server.key")
	}

	return nil
}

// buildPod is responsible for constructing the pod specification
func (b *KubeSchedulerBuilder) buildPod(kubeScheduler *kops.KubeSchedulerConfig) (*v1.Pod, error) {
	pathSrvScheduler := filepath.Join(b.PathSrvKubernetes(), "kube-scheduler")

	flags, err := flagbuilder.BuildFlagsList(kubeScheduler)
	if err != nil {
		return nil, fmt.Errorf("error building kube-scheduler flags: %v", err)
	}

	flags = append(flags, "--config="+"/var/lib/kube-scheduler/config.yaml")

	// Make sure the scheduler always looks up its authentication configuration from the API server.
	flags = append(flags, "--authentication-tolerate-lookup-failure=false")
	flags = append(flags, "--authentication-skip-lookup=false")
	// Add kubeconfig flags
	for _, flag := range []string{"authentication-", "authorization-"} {
		flags = append(flags, "--"+flag+"kubeconfig="+wellknownpaths.KubeSchedulerKubeConfig)
	}

	pod := &v1.Pod{
		TypeMeta: metav1.TypeMeta{
			APIVersion: "v1",
			Kind:       "Pod",
		},
		ObjectMeta: metav1.ObjectMeta{

View on GitHub (pinned to 4c8573c808)

Solutions

1. Read the wrapped inner error to identify the offending KubeSchedulerConfig field
2. Align the nodeup binary version with the kops version that wrote the cluster spec (kops update)
3. Correct or remove the invalid field via kops edit cluster, then re-run kops update cluster
4. Pin feature gates / custom fields to values supported by the installed kops release

Example fix

// before (spec written by newer kops than nodeup binary)
kubeScheduler:
  usePolicyConfigMap: legacy-ref
// after
kops edit cluster  # remove unsupported field
kops update cluster --yes

// Pre-render KubeSchedulerConfig flags before running nodeup
if _, err := flagbuilder.BuildFlagsList(cluster.Spec.KubeScheduler); err != nil {
	return fmt.Errorf("kubeScheduler config cannot be rendered to flags: %w", err)
}

if err := nodeupBuild(cfg); err != nil {
	wrapped := err.Error()
	if strings.Contains(wrapped, "error building kube-scheduler flags") ||
		strings.Contains(wrapped, "error building kube-scheduler pod") {
		log.Errorf("kube-scheduler flag build failed: %v", err)
		return fmt.Errorf("fix kubeScheduler config and retry: %w", err)
	}
	return err
}

When it happens

Trigger: buildPod encountering a KubeSchedulerConfig field that the reflection-based flag builder cannot render — most commonly an unexpected field type, a nil pointer handled incorrectly, or config loaded from an older/newer kops state store schema.

Common situations: State store cluster spec written by a different kops version than the nodeup binary; manual edits to kubeScheduler config adding fields flagbuilder does not support; feature-flagged fields present but not renderable.

Related errors

• error building kubeproxy flags: %v
• error building kube-scheduler pod: %v
• error marshaling pod to yaml: %v
• building nodeConfig for instanceGroup: %w
• marshalling nodeupConfig: %w

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/a90639371b9767c4. Report an issue: GitHub.