kubernetes/kops · error

error building kubernetes client: %w

Error message

error building kubernetes client: %w

What it means

Thrown by NewOpenstackVerifier when newClientSet() fails to build the Kubernetes clientset. The verifier needs in-cluster credentials (service account) to reach the API server; client construction failed before any request was made.

Source

Thrown at upup/pkg/fi/cloudup/openstack/verifier.go:91

	// node-controller should be able to renew it tokens against OpenStack API
	env.AllowReauth = true

	err = gos.Authenticate(context.TODO(), provider, env)
	if err != nil {
		return nil, err
	}

	novaClient, err := gos.NewComputeV2(provider, gophercloud.EndpointOpts{
		Type:   "compute",
		Region: region,
	})
	if err != nil {
		return nil, fmt.Errorf("error building nova client: %v", err)
	}

	kubeClient, err := newClientSet()
	if err != nil {
		return nil, fmt.Errorf("error building kubernetes client: %w", err)
	}

	return &openstackVerifier{
		novaClient: novaClient,
		kubeClient: kubeClient,
	}, nil
}

func stringInSlice(a string, list []string) bool {
	for _, b := range list {
		if b == a {
			return true
		}
	}
	return false
}

func newClientSet() (*kubernetes.Clientset, error) {

View on GitHub (pinned to 4c8573c808)

Solutions

1. Run the verifier inside the cluster (as a pod) so in-cluster config is available.
2. If running externally, provide a valid kubeconfig/KUBECONFIG and adapt newClientSet to fall back to clientcmd.
3. Ensure the pod has automountServiceAccountToken: true and the serviceaccount token secret exists.
4. Verify KUBERNETES_SERVICE_HOST/PORT env vars are set inside the container.

Example fix

// before
kubeClient, err := newClientSet() // fails outside cluster
// after
func newClientSet() (*kubernetes.Clientset, error) {
    cfg, err := rest.InClusterConfig()
    if err != nil {
        cfg, err = clientcmd.NewNonInteractiveDeferredLoadingClientConfig(
            clientcmd.NewDefaultClientConfigLoadingRules(), &clientcmd.ConfigOverrides{}).ClientConfig()
        if err != nil {
            return nil, err
        }
    }
    return kubernetes.NewForConfig(cfg)
}

if os.Getenv("KUBERNETES_SERVICE_HOST") == "" && os.Getenv("KUBECONFIG") == "" {
    if _, err := os.Stat(clientcmd.RecommendedHomeFile); err != nil {
        return errors.New("no in-cluster config and no kubeconfig available")
    }
}

kubeClient, err := newClientSet()
if err != nil {
    return nil, fmt.Errorf("error building kubernetes client: %w", err)
}

When it happens

Trigger: NewOpenstackVerifier calls newClientSet(); it fails when running outside a pod (no KUBERNETES_SERVICE_HOST/PORT), with a missing/unreadable service account token at /var/run/secrets/kubernetes.io/serviceaccount, or an invalid kubeconfig.

Common situations: Running the verifier binary locally on an admin machine instead of inside the cluster; automountServiceAccountToken disabled on the pod; missing mounted token secret; stale or unreadable kubeconfig.

Related errors

• error building corev1 client: %v
• node identity is required
• cannot build kube client: %w
• cannot load kubecfg settings for %q: %w
• cannot build kube client for %q: %w

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/1b8f2d294589470d. Report an issue: GitHub.