kubernetes/kops · critical

failed to get node config from server: %w

Error message

failed to get node config from server: %w

What it means

nodeup's Run() fetches the node (bootstrap) configuration from a config server when bootConfig.ConfigServer is configured. This error wraps any failure from getNodeConfigFromServers — network failures, TLS errors, server-side 4xx/5xx responses, or malformed responses — so the node cannot proceed with provisioning.

Source

Thrown at upup/pkg/fi/nodeup/command.go:120

	if c.CacheDir == "" {
		return fmt.Errorf("CacheDir is required")
	}

	region, err := getRegion(ctx, &bootConfig)
	if err != nil {
		return err
	}

	var configBase vfs.Path

	// If we're using a config server instead of vfs, nodeConfig will hold our configuration
	var nodeConfig *nodeup.NodeConfig

	if bootConfig.ConfigServer != nil && len(bootConfig.ConfigServer.Servers) > 0 {
		response, err := getNodeConfigFromServers(ctx, &bootConfig, region)
		if err != nil {
			return fmt.Errorf("failed to get node config from server: %w", err)
		}
		nodeConfig = response.NodeConfig
	} else if fi.ValueOf(bootConfig.ConfigBase) != "" {
		var err error
		configBase, err = vfs.Context.BuildVfsPath(*bootConfig.ConfigBase)
		if err != nil {
			return fmt.Errorf("cannot parse ConfigBase %q: %v", *bootConfig.ConfigBase, err)
		}
	} else {
		return fmt.Errorf("ConfigBase or ConfigServer is required")
	}

	var nodeupConfig nodeup.Config
	var nodeupConfigHash [32]byte
	switch {
	case nodeConfig != nil:
		if err := utils.YamlUnmarshal([]byte(nodeConfig.NodeupConfig), &nodeupConfig); err != nil {
			return fmt.Errorf("error parsing BootConfig config response: %v", err)

View on GitHub (pinned to 4c8573c808)

Solutions

1. Verify the config server address(es) in ConfigServer.Servers are correct and reachable from the node (curl from the node).
2. Check that ConfigServer.CACertificates matches the cert the config server presents; re-run kops update/rolling-update to refresh it.
3. Confirm security groups / firewall allow HTTPS from the node subnet to the config server.
4. Retry node boot — transient control-plane unavailability during cluster bring-up is a common cause.
5. If config-server mode is not intended, unset ConfigServer and provide a valid ConfigBase instead.

Example fix

// before (wrong server host in NodeUpConfig)
configServer:
  servers: ["https://api.internal.example.invalid:9000"]
// after
configServer:
  servers: ["https://api.internal.example.com:9000"]
  caCertificates: <PEM from 'kops get cluster -o yaml'>

When it happens

Trigger: kops node bootstrap with ConfigServer set (bootConfig.ConfigServer.Servers non-empty) and getNodeConfigFromServers returns an error: server unreachable, wrong address, TLS handshake failure against the server CA, or the server rejects the node's request.

Common situations: Nodes launched before the config server is reachable (security group / load balancer not yet ready), misconfigured kops-feature-flag UseConfigServer, stale or missing CA certificates in ConfigServer.CACertificates, DNS not resolving the API server, or node lacking outbound network at boot time.

Related errors

• reading kops-channels manifest %s: %w
• error trying to locate asset %q: %v
• building nodeConfig for instanceGroup: %w
• marshalling nodeupConfig: %w
• unsupported cloud provider for authenticator %q

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/179fbe48347b0a8e. Report an issue: GitHub.