What causes "error querying kubernetes version: %v" in kubernetes/kops?

Test connectivity: `kubectl --kubeconfig version` from the same host/pod

error querying kubernetes version: %v

Error message

error querying kubernetes version: %v

What it means

RunApplyChannel queries the cluster's server version via k8sClient.Discovery().ServerVersion() to gate channel addon versions. If the discovery request fails (unreachable apiserver, auth error, TLS error), it wraps the cause with this message and aborts the apply. Unlike some other paths it uses %v, so the inner error is not unwrap-able via errors.As/Is.

Source

Thrown at channels/pkg/cmd/apply_channel.go:190

	cmClient, err := certmanager.NewForConfigAndClient(restConfig, httpClient)
	if err != nil {
		return fmt.Errorf("building cert manager client: %w", err)
	}

	dynamicClient, err := f.DynamicClient()
	if err != nil {
		return fmt.Errorf("building dynamic client: %w", err)
	}

	restMapper, err := f.RESTMapper()
	if err != nil {
		return err
	}

	kubernetesVersionInfo, err := k8sClient.Discovery().ServerVersion()
	if err != nil {
		return fmt.Errorf("error querying kubernetes version: %v", err)
	}

	kubernetesVersion, err := semver.ParseTolerant(kubernetesVersionInfo.GitVersion)
	if err != nil {
		return fmt.Errorf("cannot parse kubernetes version %q", kubernetesVersionInfo.GitVersion)
	}

	// Remove Pre and Patch, as they make semver comparisons impractical
	kubernetesVersion.Pre = nil

	if len(args) == 0 {
		return fmt.Errorf("at least one channel URL is required")
	}

	var merr error
	for _, channelLocation := range args {
		menu, err := buildMenu(f.VFSContext(), kubernetesVersion, channelLocation)
		if err != nil {

View on GitHub (pinned to 4c8573c808)

Solutions

Test connectivity: `kubectl --kubeconfig <cfg> version` from the same host/pod
Verify the apiserver endpoint, DNS, and firewall rules (port 443)
Refresh credentials (kops export kubeconfig or rotated service-account tokens)
If in daemon mode during startup, wait — the loop retries automatically

Defensive patterns

Strategy: retry

Validate before calling

// Go: probe the apiserver before running apply
clientset, _ := f.KubernetesClient()
if _, err := clientset.Discovery().ServerVersion(); err != nil {
	return fmt.Errorf("precheck: apiserver unreachable: %w", err)
}

Try / catch

err := RunApplyChannel(ctx, f, out, options, args)
if err != nil && strings.Contains(err.Error(), "error querying kubernetes version") {
	// note: wrapped with %v, not unwrappable; treat as transient and back off
	time.Sleep(5 * time.Second)
	return retry(ctx)
}

Prevention

Verify DNS/firewall allow egress to the apiserver on 443
Refresh tokens/certs before expiry (kops export kubeconfig)
Rely on the daemon loop's 5s startup retry during control-plane bring-up
Alert on persistent discovery failures rather than crash-looping

When it happens

Trigger: `kops channels apply` against a cluster whose apiserver is down or unreachable; wrong endpoint/port; expired tokens or certs rejected at discovery time; network partition from the pod to the control plane.

Common situations: Running during control-plane bootstrap (normal in daemon mode — the loop retries every 5s); firewall/Security Group blocking 443; DNS not resolving the apiserver name; certificate rotation in progress.

Related errors

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/c805a38f95e0f2bb. Report an issue: GitHub.