kubernetes/kops · error

error building node labels: %w

Error message

error building node labels: %w

What it means

kOps builds the kubelet node labels for the InstanceGroup via nodelabels.BuildNodeLabels(cluster, ig). This error wraps any failure there — typically invalid or disallowed labels/roles that the builder refuses to assemble.

Source

Thrown at upup/pkg/fi/cloudup/populate_instancegroup_spec.go:280

			igKubeletConfig = &kops.KubeletConfigSpec{}
		}
		// A few settings in Kubelet override those in ControlPlaneKubelet. I'm not sure why.
		if cluster.Spec.Kubelet != nil && cluster.Spec.Kubelet.AnonymousAuth != nil && !*cluster.Spec.Kubelet.AnonymousAuth {
			igKubeletConfig.AnonymousAuth = new(false)
		}
	} else {
		if cluster.Spec.Kubelet != nil {
			igKubeletConfig = cluster.Spec.Kubelet.DeepCopy()
		} else {
			igKubeletConfig = &kops.KubeletConfigSpec{}
		}
	}

	// We include the NodeLabels in the userdata even for Kubernetes 1.16 and later so that
	// rolling update will still replace nodes when they change.
	nodeLabels, err := nodelabels.BuildNodeLabels(cluster, ig)
	if err != nil {
		return nil, fmt.Errorf("error building node labels: %w", err)
	}
	igKubeletConfig.NodeLabels = nodeLabels

	useSecureKubelet := fi.ValueOf(igKubeletConfig.AnonymousAuth)

	// While slices are overridden in most cases, taints are explicitly merged
	taints := sets.NewString(igKubeletConfig.Taints...)
	taints.Insert(igSpec.Taints...)
	if ig.Spec.Kubelet != nil {
		taints.Insert(igSpec.Kubelet.Taints...)
	}
	if cluster.Spec.Kubelet != nil {
		taints.Insert(cluster.Spec.Kubelet.Taints...)
	}
	if ig.Spec.Kubelet != nil {
		reflectutils.JSONMergeStruct(igKubeletConfig, ig.Spec.Kubelet)
	}

View on GitHub (pinned to 4c8573c808)

Solutions

1. Check the wrapped error message for the offending label and fix its key/value to satisfy Kubernetes label constraints (63 chars, alphanumerics, -, _, .)
2. Remove labels that clash with kops/kubernetes reserved prefixes
3. Run `kops toolbox instance-selector` or validate the IG with `kops validate` after editing
4. Verify kubelet config in `kops edit cluster` / `kops edit instancegroup`

Example fix

// before
spec:
  kubelet:
    nodeLabels:
      node-role.kubernetes.io/node=: this_is_a_way_too_long_label_value_that_exceeds_the_sixty_three_character_limit
// after
spec:
  kubelet:
    nodeLabels:
      workload: general

// Validate node labels against k8s constraints before applying
re := regexp.MustCompile(`^(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])?$`)
for k, v := range ig.Spec.Kubelet.NodeLabels {
    if len(v) > 63 || !re.MatchString(v) {
        return fmt.Errorf("invalid node label value %q for key %s", v, k)
    }
}

When it happens

Trigger: spec.kubelet.nodeLabels (or cluster-level equivalents) containing labels BuildNodeLabels cannot validate or merge — e.g. labels violating kubernetes label value constraints, or internal label conflicts with role-derived labels.

Common situations: Custom nodeLabels with invalid characters or overly long values; labels colliding with kops-managed keys (kops.k8s.io/*, kubernetes.io/role); config applied via `kops create cluster --set` producing malformed label strings.

Related errors

• error building node labels: %w
• invalid InstanceGroup name: %v
• spec.PublicKey is required
• adding keypair to %q is not supported
• unable to parse YAML %v: %v

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/850bc9d35fbca6d4. Report an issue: GitHub.