kubernetes/kops · error

the image for the hook exec action not set

Error message

the image for the hook exec action not set

What it means

Wraps a failure from the autoscaling DetachInstances API in AWSCloud.DetachInstance. After successfully tagging the instance, kOps asks the ASG to detach the instance without decrementing desired capacity. If the AWS call fails, the SDK error is wrapped here.

Source

Thrown at nodeup/pkg/model/hooks.go:184

	containerdRunCommand := systemd.EscapeCommand(containerdArgs)
	containerdPullCommand := systemd.EscapeCommand([]string{"/usr/bin/ctr", "--namespace", "k8s.io", "image", "pull", containerdImage})

	unit.Set("Unit", "Requires", "containerd.service")
	unit.Set("Service", "ExecStartPre", containerdPullCommand)
	unit.Set("Service", "ExecStart", containerdRunCommand)
	unit.Set("Service", "Type", "oneshot")
	unit.Set("Install", "WantedBy", "multi-user.target")

	return nil
}

// isValidExecContainerAction checks the validity of the execContainer - personally i think this validation
// should be done high up the chain, but
func isValidExecContainerAction(action *kops.ExecContainerAction) error {
	action.Image = strings.TrimSpace(action.Image)
	if action.Image == "" {
		return errors.New("the image for the hook exec action not set")
	}

	return nil
}

View on GitHub (pinned to 4c8573c808)

Solutions

1. Check the ASG still exists and contains the instance in the AWS console/CLI
2. Retry the rolling update — detach is idempotent-safe when the instance is gone
3. Verify IAM permissions for autoscaling:DetachInstances
4. Refresh cloud state with `kops rolling-update cluster --cloudonly` or re-list groups

out, err := cloud.Autoscaling().DescribeAutoScalingGroups(ctx, &autoscaling.DescribeAutoScalingGroupsInput{AutoScalingGroupNames: []string{asgName}})
if err != nil || len(out.AutoScalingGroups) == 0 { return fmt.Errorf("ASG %q unavailable for detach", asgName) }

err := cloud.DetachInstance(ctx, instance)
if err != nil && strings.Contains(err.Error(), "error detaching instance") {
  // check whether the instance already left the ASG; treat AlreadyDetached/Terminated as success
  if asgHasInstance(ctx, cloud, asgName, id) { retryDetach() } else { logAlreadyDetached() }
}

When it happens

Trigger: DetachInstances call fails because the ASG no longer exists, the instance was already detached or terminated, the instance ID is not in the ASG, or throttling/credentials issues.

Common situations: Concurrent rolling updates double-detaching the same node; ASG deleted manually while kops still tracks it; instance already replaced by the ASG; transient AWS throttling.

Related errors

• failed to detach instance: %v
• DIGITALOCEAN_ACCESS_TOKEN is required
• IP version is incorrect
• ErrAlreadyExists
• DIGITALOCEAN_ACCESS_TOKEN is required

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/aa0d374a41a0114c. Report an issue: GitHub.