kubernetes/kops · error

KubeProxy not configured

Error message

KubeProxy not configured

What it means

KubeProxyBuilder.buildPod requires a KubeProxy configuration from the nodeup config (b.NodeupConfig.KubeProxy). If it is nil, nodeup cannot construct the kube-proxy static pod at all and returns 'KubeProxy not configured'. nodeup refuses to guess defaults: kube-proxy settings must be present in the config handed to the binary.

Source

Thrown at nodeup/pkg/model/kube_proxy.go:107

	{
		c.AddTask(&nodetasks.File{
			Path:        "/var/log/kube-proxy.log",
			Contents:    fi.NewStringResource(""),
			Type:        nodetasks.FileType_File,
			Mode:        s("0400"),
			IfNotExists: true,
		})
	}

	return nil
}

// buildPod is responsible constructing the pod spec
func (b *KubeProxyBuilder) buildPod() (*v1.Pod, error) {
	c := b.NodeupConfig.KubeProxy
	if c == nil {
		return nil, fmt.Errorf("KubeProxy not configured")
	}

	// On distributions where iptables is not functional (e.g., RHEL10+),
	// we must use nftables proxy mode instead.
	// In particular when we forced nftables on rhel10, we should also pass the --proxy-mode=nftables flag.
	if b.Distribution.ForceNftables() {
		if c.ProxyMode == "" || c.ProxyMode == "iptables" {
			klog.Infof("Distribution %v requires nftables; overriding kube-proxy mode from %q to nftables", b.Distribution, c.ProxyMode)
			c.ProxyMode = "nftables"
		}
	}

	if c.Master == "" {
		if b.HasAPIServer {
			// Use the local API server to avoid a kube-proxy/DNS bootstrap cycle. Dedicated
			// apiserver nodes also lack an /etc/hosts entry for the API internal name.
			c.Master = "https://127.0.0.1"
		} else {

View on GitHub (pinned to 4c8573c808)

Solutions

1. Regenerate the node's config with `kops update cluster --yes` (and rolling update) so NodeupConfig includes spec.kubeProxy
2. Verify the cluster spec has a kubeProxy section: `kops get cluster -o yaml | grep -A5 kubeProxy`; re-add it via `kops edit cluster` if missing
3. Ensure the nodeup binary version matches the kops version that generated the config
4. If kube-proxy is intentionally not used, use a nodeup/kops flow that supports omitting it rather than a nil config

Example fix

// before (cluster spec missing kube-proxy)
spec:
  kubelet: {}
// after (kops edit cluster)
spec:
  kubeProxy:
    enabled: true
    master: https://api.internal.example.com
# then: kops update cluster --yes && kops rolling-update cluster --yes

func validateKubeProxyConfig(cfg *nodeup.Config) error {
    if cfg == nil || cfg.KubeProxy == nil {
        return errors.New("KubeProxy not configured: NodeupConfig.KubeProxy must be set before running nodeup")
    }
    return nil
}
// call before launching nodeup

func kubeProxyConfigured(b *KubeProxyBuilder) bool {
    return b != nil && b.NodeupConfig != nil && b.NodeupConfig.KubeProxy != nil
}

if err := b.buildPod(); err != nil {
    if strings.Contains(err.Error(), "KubeProxy not configured") {
        // regenerate NodeupConfig from cluster spec and retry
    }
    return err
}

When it happens

Trigger: Build -> buildPod is invoked on a node whose NodeupConfig has a nil KubeProxy field — i.e. the nodeup config file/struct passed to nodeup lacks the kubeProxy section.

Common situations: Hand-crafted or copied NodeupConfig files missing kubeProxy; running an old nodeup against config produced by a newer kops (or vice versa) where the struct layout changed; partially failed `kops update cluster` that did not push a complete config; kube-proxy intentionally removed from the cluster spec while nodeup still expects it.

Related errors

• error building kube-proxy manifest: %v
• error marshaling manifest to yaml: %v
• error marshaling pod to yaml: %v
• error building kube-controller-manager flags: %v
• error building kubeproxy flags: %v

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/bed9ea3876bb9e44. Report an issue: GitHub.