kubernetes/kubernetes · error

failed to construct kubelet dependencies: %w

Error message

failed to construct kubelet dependencies: %w

What it means

Returned from the kubelet RunE (cmd/kubelet/app/server.go:282) when UnsecuredDependencies fails while constructing the default kubelet Dependencies. UnsecuredDependencies calls InitializeTLS (cert/key generation/loading, TLS cipher/version parsing), ProbeVolumePlugins, and newTracerProvider; a failure in any of these aborts dependency construction.

Source

Thrown at cmd/kubelet/app/server.go:282

			// We always validate the local configuration (command line + config file).
			if err := kubeletconfigvalidation.ValidateKubeletConfiguration(kubeletConfig, utilfeature.DefaultFeatureGate); err != nil {
				return fmt.Errorf("failed to validate kubelet configuration, error: %w, path: %s", err, kubeletConfig)
			}

			if (kubeletConfig.KubeletCgroups != "" && kubeletConfig.KubeReservedCgroup != "") && (strings.Index(kubeletConfig.KubeletCgroups, kubeletConfig.KubeReservedCgroup) != 0) {
				logger.Info("unsupported configuration:KubeletCgroups is not within KubeReservedCgroup")
			}

			// construct a KubeletServer from kubeletFlags and kubeletConfig
			kubeletServer := &options.KubeletServer{
				KubeletFlags:         *kubeletFlags,
				KubeletConfiguration: *kubeletConfig,
			}

			// use kubeletServer to construct the default KubeletDeps
			kubeletDeps, err := UnsecuredDependencies(ctx, kubeletServer, utilfeature.DefaultFeatureGate)
			if err != nil {
				return fmt.Errorf("failed to construct kubelet dependencies: %w", err)
			}

			if utilfeature.DefaultFeatureGate.Enabled(zpagesfeatures.ComponentFlagz) {
				if cleanFlagSet != nil {
					namedFlagSet := map[string]*pflag.FlagSet{server.ComponentKubelet: cleanFlagSet}
					kubeletDeps.Flagz = flagz.NamedFlagSetsReader{FlagSets: cliflag.NamedFlagSets{FlagSets: namedFlagSet}}
				}
			}

			if err := checkPermissions(ctx); err != nil {
				logger.Error(err, "Kubelet running with insufficient permissions")
			}

			// Log skipped drop-in files if any were encountered during configuration merge
			if len(skippedDropinFiles) > 0 {
				for _, skippedFile := range skippedDropinFiles {
					logger.V(4).Info("Skipped file in drop-in directory (does not have .conf extension)", "file", skippedFile)
				}

View on GitHub (pinned to b882c60b40)

Solutions

1. Ensure --cert-dir exists and is writable by the kubelet user, or provide valid --tls-cert-file/--tls-private-key-file.
2. Correct --tls-min-version and --tls-cipher-suites to supported values.
3. Validate tracing configuration (OTLP endpoint, sampling) if set.
4. Read the wrapped error to identify whether TLS, volume plugins, or tracing caused the failure.

Example fix

// before
--tls-min-version=TLSv1.0
// after
--tls-min-version=VersionTLS12

// Pre-check TLS inputs before UnsecuredDependencies.
if kc.TLSMinVersion != "" {
    if _, err := cliflag.TLSVersion(kc.TLSMinVersion); err != nil { return err }
}
if len(kc.TLSCipherSuites) > 0 {
    if _, err := cliflag.TLSCipherSuites(kc.TLSCipherSuites); err != nil { return err }
}
// Ensure cert-dir is writable.
if fi, err := os.Stat(kf.CertDirectory); err != nil || !fi.IsDir() {
    return fmt.Errorf("cert-dir %q unusable", kf.CertDirectory)
}

deps, err := UnsecuredDependencies(ctx, kubeletServer, featureGate)
if err != nil {
    return fmt.Errorf("failed to construct kubelet dependencies: %w", err)
}

When it happens

Trigger: TLS setup failure: cannot read/write --tls-cert-file/--tls-private-key-file or --cert-dir, or invalid --tls-min-version / --tls-cipher-suites / curve preferences; volume plugin probe error; tracer/OTLP provider construction error from invalid tracing config.

Common situations: Cert directory not writable or out of disk for self-signed cert generation; invalid TLS cipher/version strings; malformed tracing configuration; a volume plugin registration error from a bad --volume-plugin-dir.

Related errors

• unable to generate self signed cert: %w
• cannot exit on lock file contention: no lock file specified
• runtime api version is not supported
• container runtime status check may not have completed yet
• failed to create Kubernetes client for %q: %w

AI-assisted analysis of kubernetes/kubernetes@b882c60b40 (2026-08-07). Data as JSON: /api/errors/5ba8a9f8c00a82ed. Report an issue: GitHub.