kubernetes/kops · error

error building kubeproxy flags: %v

Error message

error building kubeproxy flags: %v

What it means

nodeup's KubeProxyBuilder builds the kube-proxy static pod and uses flagbuilder.BuildFlagsList to serialize the KubeProxyConfig struct into kube-proxy CLI flags. When that reflection-based flag builder returns an error (typically a field whose flag tag is invalid or a type it cannot render), the builder wraps it with "error building kubeproxy flags: %v" and aborts building the kube-proxy task, so the node manifest fails to generate.

Source

Thrown at nodeup/pkg/model/kube_proxy.go:154

		resourceLimits["cpu"] = *c.CPULimit
	}

	if c.MemoryRequest != nil {
		resourceRequests["memory"] = *c.MemoryRequest
	}

	if c.MemoryLimit != nil {
		resourceLimits["memory"] = *c.MemoryLimit
	}

	if c.ConntrackMaxPerCore == nil {
		defaultConntrackMaxPerCore := int32(131072)
		c.ConntrackMaxPerCore = &defaultConntrackMaxPerCore
	}

	flags, err := flagbuilder.BuildFlagsList(c)
	if err != nil {
		return nil, fmt.Errorf("error building kubeproxy flags: %v", err)
	}

	flags = append(flags, []string{
		"--kubeconfig=/var/lib/kube-proxy/kubeconfig",
		"--oom-score-adj=-998",
	}...)

	image := b.RemapImage(c.Image)

	container := &v1.Container{
		Name:  "kube-proxy",
		Image: image,
		Resources: v1.ResourceRequirements{
			Requests: resourceRequests,
			Limits:   resourceLimits,
		},
		SecurityContext: &v1.SecurityContext{
			Privileged: new(true),

View on GitHub (pinned to 4c8573c808)

Solutions

1. Inspect the wrapped inner error to identify which KubeProxyConfig field failed flag conversion
2. Fix or remove the offending field in the cluster spec (kops edit cluster) and re-run kops update/replace
3. Validate the cluster spec with kops toolbox dump / kops validate before running nodeup
4. If caused by a kops bug, upgrade to a patched kops release

Example fix

// before (spec)
kubeProxy:
  proxyMode: "iptables "   # trailing space / invalid value passes through to flag builder
// after
kops edit cluster  # set kubeProxy.proxyMode: iptables
kops update cluster --yes && kops rolling-update cluster --yes

// Validate kube-proxy config fields before generating the manifest
cfg := cluster.Spec.KubeProxy
if cfg != nil && cfg.ProxyMode != "" {
	valid := map[string]bool{"iptables": true, "ipvs": true, "nftables": true}
	if !valid[cfg.ProxyMode] {
		return fmt.Errorf("invalid kubeProxy.proxyMode %q", cfg.ProxyMode)
	}
}
// Optionally pre-render flags in a dry-run to catch flagbuilder issues early
if _, err := flagbuilder.BuildFlagsList(cfg); err != nil {
	return fmt.Errorf("kubeProxy config cannot be rendered to flags: %w", err)
}

// nodeup is not caller-recoverable; capture and surface the wrapped cause
if err := runNodeupModel(); err != nil {
	if strings.Contains(err.Error(), "error building kubeproxy flags") {
		log.Errorf("kube-proxy flag build failed, check kubeProxy config: %v", err)
	}
	return err
}

When it happens

Trigger: Running nodeup model construction (KubeProxyBuilder.Build -> buildPod) with a KubeProxyConfig containing a value flagbuilder cannot convert — e.g. an unsupported field type introduced by a config schema change or a malformed custom kube-proxy config in the cluster spec.

Common situations: Clusters with hand-edited cluster.yaml / kops cluster spec fields under kubeProxy; upgrading kops versions where KubeProxyConfig gained fields the flag builder mis-handles; generated manifests in CI where config was populated from JSON/YAML with unexpected types.

Related errors

• error building kube-proxy manifest: %v
• error marshaling manifest to yaml: %v
• KubeProxy not configured
• error building kube-scheduler flags: %v
• building nodeConfig for instanceGroup: %w

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/7d10177be7315ffe. Report an issue: GitHub.