kubernetes/kubernetes · critical

error building service resolver: %w

Error message

error building service resolver: %w

What it means

Emitted by CreateKubeAPIServerConfig when buildServiceResolver fails. The service resolver maps aggregator webhook/proxy Service objects to dial targets; depending on --enable-aggregator-routing it builds either a ClusterIP resolver or an Endpoint-based resolver over the core/v1 Service lister and loopback host.

Source

Thrown at cmd/kube-apiserver/app/server.go:237

) {
	// global stuff
	capabilities.Setup(opts.AllowPrivileged, opts.MaxConnectionBytesPerSec)

	// additional admission initializers
	kubeAdmissionConfig := &kubeapiserveradmission.Config{}
	kubeInitializers, err := kubeAdmissionConfig.New()
	if err != nil {
		return nil, nil, nil, fmt.Errorf("failed to create admission plugin initializer: %w", err)
	}

	endpointSliceGetter, err := proxy.NewEndpointSliceIndexerGetter(versionedInformers.Discovery().V1().EndpointSlices())
	if err != nil {
		return nil, nil, nil, fmt.Errorf("failed to create endpoint slice getter: %w", err)
	}

	serviceResolver, err := buildServiceResolver(opts.EnableAggregatorRouting, genericConfig.LoopbackClientConfig.Host, versionedInformers, endpointSliceGetter)
	if err != nil {
		return nil, nil, nil, fmt.Errorf("error building service resolver: %w", err)
	}
	controlplaneConfig, admissionInitializers, err := controlplaneapiserver.CreateConfig(opts.CompletedOptions, genericConfig, versionedInformers, endpointSliceGetter, storageFactory, serviceResolver, kubeInitializers)
	if err != nil {
		return nil, nil, nil, err
	}

	config := &controlplane.Config{
		ControlPlane: *controlplaneConfig,
		Extra: controlplane.Extra{
			KubeletClientConfig: opts.KubeletConfig,

			ServiceIPRange:          opts.PrimaryServiceClusterIPRange,
			APIServerServiceIP:      opts.APIServerServiceIP,
			SecondaryServiceIPRange: opts.SecondaryServiceClusterIPRange,

			APIServerServicePort: 443,

			ServiceNodePortRange:      opts.ServiceNodePortRange,

View on GitHub (pinned to b882c60b40)

Solutions

1. Inspect the wrapped error for the underlying resolver construction failure.
2. Verify the versionedInformers passed to CreateKubeAPIServerConfig is initialised and the core/v1 Services informer is available.
3. If you do not need aggregation, confirm --enable-aggregator-routing is unset (defaults to ClusterIP resolver, the simpler path).

// In custom server assembly, surface the wrapped resolver error.
config, _, _, err := app.CreateKubeAPIServerConfig(opts, genericConfig, informers, storageFactory)
if err != nil {
    var resolverErr *proxy.ResolverError // hypothetical; match real type from wrapped chain
    if errors.As(err, &resolverErr) {
        return fmt.Errorf("service resolver setup failed (check informers/aggregator routing): %w", err)
    }
    return err
}

When it happens

Trigger: CreateKubeAPIServerConfig at server.go:235-237 when buildServiceResolver (server.go:297) returns an error. In stock code buildServiceResolver only errors if its internal construction paths fail (the loopback parse is swallowed, so failures are rare and usually from nil informers in custom builds).

Common situations: Mostly seen with custom apiserver aggregation setups; can surface if the versioned informer factory was not provided to CreateKubeAPIServerConfig, or with malformed loopback host config.

Related errors

• failed to create endpoint slice getter: %w
• error determining service IP ranges: %v
• service-cluster-ip-range[0] is not a valid cidr
• error determining service IP ranges for primary service cidr
• service-cluster-ip-range[1] is not an ip net

AI-assisted analysis of kubernetes/kubernetes@b882c60b40 (2026-08-07). Data as JSON: /api/errors/6949c7e3f9a4fa37. Report an issue: GitHub.