kubernetes/kops · error

unknown CNI plugin binaries asset: %s

Error message

unknown CNI plugin binaries asset: %s

What it means

After the arch switch, kOps verifies that a default cniAssetURL was actually assigned. For a known architecture, the version-specific switch (IsGTE checks against Kubernetes 1.32/1.34/1.35/1.36) has no default case that assigns a URL, so if the instance group's Kubernetes version predates all known thresholds the URL stays empty and this error is thrown.

Source

Thrown at pkg/nodemodel/wellknownassets/cni.go:109

			cniAssetURL = defaultCNIAssetAmd64K8s_32
		}
	case architectures.ArchitectureArm64:
		switch {
		case ig.KubernetesVersion().IsGTE("1.36"):
			cniAssetURL = defaultCNIAssetArm64K8s_36
		case ig.KubernetesVersion().IsGTE("1.35"):
			cniAssetURL = defaultCNIAssetArm64K8s_35
		case ig.KubernetesVersion().IsGTE("1.34"):
			cniAssetURL = defaultCNIAssetArm64K8s_34
		case ig.KubernetesVersion().IsGTE("1.32"):
			cniAssetURL = defaultCNIAssetArm64K8s_32
		}
	default:
		return nil, fmt.Errorf("unknown arch for CNI plugin binaries asset: %s", arch)
	}

	if cniAssetURL == "" {
		return nil, fmt.Errorf("unknown CNI plugin binaries asset: %s", arch)
	} else {
		klog.V(2).Infof("Adding CNI plugin binaries asset: %s", cniAssetURL)
	}

	u, err := url.Parse(cniAssetURL)
	if err != nil {
		return nil, fmt.Errorf("unable to parse CNI plugin binaries asset URL %q: %v", cniAssetURL, err)
	}

	asset, err := assetBuilder.RemapFile(u, nil)
	if err != nil {
		return nil, fmt.Errorf("unable to remap CNI plugin binaries asset: %v", err)
	}

	return asset, nil
}

View on GitHub (pinned to 4c8573c808)

Solutions

1. Upgrade the cluster's KubernetesVersion to >= 1.32, or use the kOps version that supports your Kubernetes version
2. Set CNI_VERSION_URL and CNI_ASSET_HASH_STRING env vars to pin an appropriate CNI plugin release explicitly
3. Verify the instance group spec's kubernetesVersion is parsed correctly (check cluster.yaml for typos like "1,32")
4. If calling FindCNIAssets directly, pass an instance group with a supported KubernetesVersion

Example fix

// before (cluster.yaml)
kubernetesVersion: 1.31.0
// after
kubernetesVersion: 1.32.0

if !ig.KubernetesVersion().IsGTE("1.32") {
    return fmt.Errorf("kubernetes version %s has no default CNI asset in this kOps build; upgrade or set CNI_VERSION_URL", ig.KubernetesVersion())
}

if _, err := FindCNIAssets(ig, assetBuilder, arch); err != nil {
    if strings.Contains(err.Error(), "unknown CNI plugin binaries asset") {
        klog.Errorf("kubernetes version too old for default CNI assets; upgrade to >=1.32 or set CNI_VERSION_URL/CNI_ASSET_HASH_STRING: %v", err)
    }
    return err
}

When it happens

Trigger: FindCNIAssets is called with a valid arch (amd64/arm64), no CNI_VERSION_URL/CNI_ASSET_HASH_STRING override, and ig.KubernetesVersion() is below every IsGTE threshold (i.e. < 1.32), leaving cniAssetURL == "".

Common situations: Cluster spec with an old Kubernetes version (e.g. 1.30 or 1.31) whose CNI default was removed from this kOps build; a KubernetesVersion that failed to parse and compares below all thresholds; running a newer kOps against a legacy cluster spec.

Related errors

• unable to parse CNI plugin binaries asset URL %q: %v
• unable to parse CNI plugin binaries asset hash %q: %v
• unable to parse KubernetesVersion %q: %w
• invalid base channel location: %q
• error parsing Kubernetes version %q: %v

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/ab52e1954f678c03. Report an issue: GitHub.