kubernetes/kops · error

error getting host %v: %w

Error message

error getting host %v: %w

What it means

This wraps any error from the controller-runtime client Get that is NOT a NotFound, when fetching the kops.Host for a bootstrapping node. It signals an infrastructure/API problem (API server unreachable, RBAC denial, timeout, CRD missing) rather than a missing Host record, and the underlying error is chained via %w.

Source

Thrown at pkg/bootstrap/pkibootstrap/pkiverifier/verifier.go:143

	if !verifySignature(signingKey, token.Data, token.Signature) {
		return nil, fmt.Errorf("failed to verify claim signature for node")
	}

	return result, nil
}

func (v *verifier) getSigningKey(ctx context.Context, tokenData *pkibootstrap.AuthTokenData) (*bootstrap.VerifyResult, crypto.PublicKey, error) {
	nodeName := tokenData.Instance
	id := types.NamespacedName{
		Namespace: "kops-system",
		Name:      nodeName,
	}
	var host kops.Host
	if err := v.client.Get(ctx, id, &host); err != nil {
		if apierrors.IsNotFound(err) {
			return nil, nil, fmt.Errorf("host not found for %v", id)
		}
		return nil, nil, fmt.Errorf("error getting host %v: %w", id, err)
	}

	// TODO: Check instance-group matches request (does it matter?)

	if host.Spec.PublicKey == "" {
		return nil, nil, fmt.Errorf("host %v did not have public-key", id)
	}
	instanceGroup := host.Spec.InstanceGroup
	if instanceGroup == "" {
		return nil, nil, fmt.Errorf("host %v did not have spec.instanceGroup", id)
	}
	pubKey, err := pki.ParsePEMPublicKey([]byte(host.Spec.PublicKey))
	if err != nil {
		return nil, nil, fmt.Errorf("failed to parse public key: %w", err)
	}

	var sans []string

View on GitHub (pinned to 4c8573c808)

Solutions

1. Read the wrapped cause (errors.Unwrap or kops-controller logs) to identify whether it is RBAC, connection, or CRD related
2. Ensure the Host CRD (kops.k8s.io) is installed: kubectl get crd hosts.kops.k8s.io
3. Grant kops-controller's ServiceAccount RBAC get/list on hosts.kops.k8s.io in the kops-system namespace
4. Verify kops-controller can reach the API server (network policies, DNS, etcd health)

Example fix

// before: RBAC missing, Get returns Forbidden
// kubectl auth can-i get hosts.kops.k8s.io -n kops-system --as=system:serviceaccount:kops-system:kops-controller -> no

// after: add ClusterRole rule
// rules:
// - apiGroups: ["kops.k8s.io"]
//   resources: ["hosts"]
//   verbs: ["get", "list", "watch"]

var probe kops.Host
if err := c.Get(ctx, types.NamespacedName{Namespace: "kops-system", Name: probeName}, &probe); err != nil {
    if !apierrors.IsNotFound(err) {
        return fmt.Errorf("API access to Hosts is broken: %w", err)
    }
}

func isAPIAccessError(err error) bool {
    return err != nil && !apierrors.IsNotFound(err) && strings.Contains(err.Error(), "error getting host")
}

result, err := verifier.VerifyToken(ctx, req, token, body)
if err != nil {
    var se *apierrors.StatusError
    if errors.As(err, &se) {
        switch apierrors.ReasonForError(se) {
        case metav1.ReasonForbidden:
            return fmt.Errorf("fix kops-controller RBAC for hosts.kops.k8s.io: %w", err)
        }
    }
    return err
}

When it happens

Trigger: VerifyToken -> getSigningKey issues a client.Get for a Host in kops-system and the API server returns a non-NotFound error: connection refused/timeout, 403 Forbidden from RBAC on kops.k8s.io/hosts, Host CRD not installed (no matches for kind), or too many requests/throttling.

Common situations: kops-controller ServiceAccount lacks RBAC rules for the Host resource; Host CRD not yet applied after an upgrade; API server overloaded or etcd degraded; network policy or egress issue between kops-controller and apiserver; custom resource renamed across kops versions.

Understand the failure class

Background: "API request failed": what wrapped HTTP errors from external APIs mean and how to find the real cause — this error's family across 29 libraries.

Related errors

• error querying namespace %q: %v
• error listing nodes: %v
• error listing Keysets: %v
• error updating keyset %q: %v
• error reading SSHCredential: %v

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/3076b6c56acc50d6. Report an issue: GitHub.