What causes "error executing command %q: %v Output: %s" in kubernetes/kops?

Inspect the Output: section of the error for the underlying command failure

error executing command %q: %v Output: %s

Error message

error executing command %q: %v
Output: %s

What it means

During nodeup's RenderLocal for a file task with OnChangeExecute, an associated command was run via exec.Command and returned a non-zero exit status. The error wraps the command string, the exec error (typically 'exit status N'), and the combined stdout/stderr output. It indicates the change hook configured for the file failed on this node.

Source

Thrown at upup/pkg/fi/nodeup/nodetasks/file.go:325

	if changes.Owner != nil || changes.Group != nil {
		ownerChanged, err := fi.EnsureFileOwner(e.Path, fi.ValueOf(e.Owner), fi.ValueOf(e.Group))
		if err != nil {
			return fmt.Errorf("error changing owner/group on %q: %v", e.Path, err)
		}
		changed = changed || ownerChanged
	}

	if changed && e.OnChangeExecute != nil {
		for _, args := range e.OnChangeExecute {
			human := strings.Join(args, " ")

			klog.Infof("Changed; will execute OnChangeExecute command: %q", human)

			cmd := exec.Command(args[0], args[1:]...)
			output, err := cmd.CombinedOutput()
			if err != nil {
				return fmt.Errorf("error executing command %q: %v\nOutput: %s", human, err, output)
			}
		}
	}

	return nil
}

View on GitHub (pinned to 4c8573c808)

Solutions

Inspect the Output: section of the error for the underlying command failure
Run the same command manually on the node to reproduce and debug
Fix the OnChangeExecute command path/args in the file task definition
Verify required binaries/services exist at the time nodeup runs

Example fix

// before
onChange := "/usr/local/sbin/reload-thing"
// after
// ensure the script exists and is executable, or guard it:
onChange = "[ -x /usr/local/sbin/reload-thing ] && /usr/local/sbin/reload-thing || true"

Defensive patterns

Strategy: try-catch

Validate before calling

// before invoking nodeup, sanity-check OnChangeExecute targets exist in the image
if !fileExists(node, "/usr/local/sbin/reload-thing") { t.Fatalf("OnChangeExecute target missing") }

Try / catch

if err := task.RenderLocal(ctx, a, b); err != nil {
  if strings.Contains(err.Error(), "error executing command") {
    // parse 'Output:' section, log command output, decide on retry/abort
  }
  return err
}

Prevention

Keep OnChangeExecute commands idempotent and present in the base image
Test file tasks with OnChangeExecute in a VM before rollout
Read the Output: section first — it contains the real failure

When it happens

Trigger: A File task with OnChangeExecute set is rendered, its contents/permissions changed, and the configured command (e.g. systemctl reload, postinstall script) exits non-zero.

Common situations: A post-change script references a binary not yet installed on the node; a service being reloaded is not running; a script has a syntax error or wrong path after image changes.

Related errors

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/c0aee5516be4fad5. Report an issue: GitHub.