duration time must be greater than one second as set via com

Error message

duration time must be greater than one second as set via command line option reconcile-sync-loop-period

What it means

Validation error from AttachDetachControllerOptions.Validate() when the --attach-detach-reconcile-sync-period flag is set to a duration less than one second. The attach-detach controller periodically reconciles volume attach/detach state against pods; a sub-second period would cause excessive reconcile loops and is rejected at startup. The check compares o.ReconcilerSyncLoopPeriod.Duration against time.Second.

Source

Thrown at cmd/kube-controller-manager/app/options/attachdetachcontroller.go:65

	}

	cfg.DisableAttachDetachReconcilerSync = o.DisableAttachDetachReconcilerSync
	cfg.ReconcilerSyncLoopPeriod = o.ReconcilerSyncLoopPeriod
	cfg.DisableForceDetachOnTimeout = o.DisableForceDetachOnTimeout

	return nil
}

// Validate checks validation of AttachDetachControllerOptions.
func (o *AttachDetachControllerOptions) Validate() []error {
	if o == nil {
		return nil
	}

	errs := []error{}

	if o.ReconcilerSyncLoopPeriod.Duration < time.Second {
		errs = append(errs, fmt.Errorf("duration time must be greater than one second as set via command line option reconcile-sync-loop-period"))
	}

	return errs
}

View on GitHub (pinned to b882c60b40)

Solutions

Set --attach-detach-reconcile-sync-period to at least 1s (default is typically 60s for production stability).
Use explicit time units in the flag value, e.g. --attach-detach-reconcile-sync-period=1m or =30s.
If loading from a config file, verify the ReconcilerSyncLoopPeriod field parses as a valid Go duration >= 1s.
Remove the flag entirely to accept the default, which always passes validation.

Example fix

# before
kube-controller-manager --attach-detach-reconcile-sync-period=500ms

# after
kube-controller-manager --attach-detach-reconcile-sync-period=60s

Defensive patterns

Strategy: validation

Validate before calling

// Validate the reconcile sync period before passing it to the controller manager options:
if o.ReconcilerSyncLoopPeriod.Duration < time.Second {
    return fmt.Errorf("attach-detach-reconcile-sync-period must be >= 1s, got %v", o.ReconcilerSyncLoopPeriod.Duration)
}
// Accept the value only after this passes.

Type guard

func isValidReconcileSyncPeriod(d time.Duration) bool {
    return d >= time.Second
}

Prevention

Always use explicit time units (e.g. 60s, 1m) in flag values rather than bare numbers.
Validate durations in deployment automation (Ansible, Helm, kubeadm) before applying.

When it happens

Trigger: Starting kube-controller-manager with --attach-detach-reconcile-sync-period set to a value < 1s (e.g. 500ms, 0s, or a negative duration). The Validate() method runs during options validation before any controller starts.

Common situations: Operator sets the sync period too low trying to speed up volume reconciliation; a config file or Helm chart injects a small duration value; unit confusion (passing a bare integer interpreted as nanoseconds); typo where the value is omitted and defaults to zero.

Related errors

AI-assisted analysis of kubernetes/kubernetes@b882c60b40 (2026-08-07). Data as JSON: /api/errors/77157662ff0ffc9d. Report an issue: GitHub.