kubernetes/kops · error

getting kubernetes client: %w

Error message

getting kubernetes client: %w

What it means

RunRollingUpdateCluster builds a Kubernetes client from the REST config so it can poll node/draining state during a rolling update. If client-go's kubernetes.NewForConfigAndClient fails — e.g. because the REST config is malformed (bad host URL, invalid TLS material) — it wraps the error as "getting kubernetes client: %w". This means the k8s API client could not even be constructed, before any network request was made.

Source

Thrown at cmd/kops/rolling-update_cluster.go:263

		return err
	}

	var nodes []v1.Node
	var k8sClient kubernetes.Interface
	if !options.CloudOnly {
		restConfig, err := f.RESTConfig(ctx, cluster, options.CreateKubecfgOptions)
		if err != nil {
			return fmt.Errorf("getting rest config: %w", err)
		}

		httpClient, err := f.HTTPClient(restConfig)
		if err != nil {
			return fmt.Errorf("getting http client: %w", err)
		}

		k8sClient, err = kubernetes.NewForConfigAndClient(restConfig, httpClient)
		if err != nil {
			return fmt.Errorf("getting kubernetes client: %w", err)
		}

		nodeList, err := k8sClient.CoreV1().Nodes().List(ctx, metav1.ListOptions{})
		if err != nil {
			fmt.Fprintf(os.Stderr, "Unable to reach the kubernetes API.\n")
			fmt.Fprintf(os.Stderr, "Use --cloudonly to do a rolling-update without confirming progress with the k8s API\n\n")
			return fmt.Errorf("error listing nodes in cluster: %v", err)
		}

		if nodeList != nil {
			nodes = nodeList.Items
		}
	}

	list, err := clientset.InstanceGroupsFor(cluster).List(ctx, metav1.ListOptions{})
	if err != nil {
		return err
	}

View on GitHub (pinned to 4c8573c808)

Solutions

1. Verify the kubeconfig used by kops (kops export kubeconfig <cluster> --admin) and regenerate it if certificates were rotated
2. Inspect the wrapped cause in %w for which field is invalid (host URL vs TLS material) and fix that field
3. Run with --cloudonly to skip k8s client construction if API-side validation is not needed
4. Ensure the kubectl context points at the correct cluster: kubectl config current-context

Example fix

// before: stale kubeconfig with rotated CA
kops rolling-update cluster mycluster.k8s.local
// error: getting kubernetes client: ... tls: failed to find any PEM data
// after
kops export kubeconfig mycluster.k8s.local --admin
kops rolling-update cluster mycluster.k8s.local

// validate kubeconfig before running
cfg, err := clientcmd.NewNonInteractiveDeferredLoadingClientConfig(
    clientcmd.NewDefaultClientConfigLoadingRules(), nil).ClientConfig()
if err != nil { return fmt.Errorf("kubeconfig invalid: %w", err) }
if cfg.Host == "" || len(cfg.CAData) == 0 { return errors.New("kubeconfig missing host or CA") }

func restConfigUsable(c *rest.Config) bool {
    return c != nil && c.Host != "" && (len(c.CAData) > 0 || c.CAFile != "")
}

if err != nil {
    var perr error
    if errors.As(err, &perr) { klog.Infof("cause: %v", perr) }
    return fmt.Errorf("building k8s client failed: %w; run `kops export kubeconfig <cluster> --admin`", err)
}

When it happens

Trigger: kubernetes.NewForConfigAndClient(restConfig, httpClient) returns an error: the restConfig obtained from f.RESTConfig(ctx, cluster, options.CreateKubecfgOptions) has an invalid API server URL, unparseable CA cert/client cert/key, or unsupported transport settings (only when --cloudonly is NOT set).

Common situations: Stale or hand-edited kubeconfig for the cluster (wrong server host, expired/rotated client certificates, corrupt CA data); kops admin kubeconfig regenerated with a different CA; pointing at a custom API endpoint with a malformed URL scheme.

Related errors

• building kube client: %w
• cannot build kube client: %w
• building kubernetes client: %w
• building kubernetes client for node labeler: %w
• building cert manager client: %w

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/5929b27fd9fd1cff. Report an issue: GitHub.