kubernetes/kubernetes · critical

failed to create kubelet: %w

Error message

failed to create kubelet: %w

What it means

A catch-all wrapper around createAndInitKubelet → kubelet.NewMainKubelet failing (server.go:1321). NewMainKubelet performs dozens of validations (container runtime, volume plugins, auth, image GC, eviction, etc.), so the wrapped %w is the real diagnostic.

Source

Thrown at cmd/kubelet/app/server.go:1321

	capabilities.Initialize(capabilities.Capabilities{
		AllowPrivileged: true,
	})

	credentialprovider.SetPreferredDockercfgPath(kubeServer.RootDirectory)
	logger.V(2).Info("Using root directory", "path", kubeServer.RootDirectory)

	if kubeDeps.OSInterface == nil {
		kubeDeps.OSInterface = kubecontainer.RealOS{}
	}

	k, err := createAndInitKubelet(ctx,
		kubeServer,
		kubeDeps,
		hostname,
		nodeName,
		nodeIPs)
	if err != nil {
		return fmt.Errorf("failed to create kubelet: %w", err)
	}

	// NewMainKubelet should have set up a pod source config if one didn't exist
	// when the builder was run. This is just a precaution.
	if kubeDeps.PodConfig == nil {
		return fmt.Errorf("failed to create kubelet, pod source config was nil")
	}
	podCfg := kubeDeps.PodConfig

	if err := rlimit.SetNumFiles(uint64(kubeServer.MaxOpenFiles)); err != nil {
		logger.Error(err, "Failed to set rlimit on max file handles")
	}

	startKubelet(ctx, k, podCfg, &kubeServer.KubeletConfiguration, kubeDeps, kubeServer.EnableServer)
	logger.Info("Started kubelet")

	return nil
}

View on GitHub (pinned to b882c60b40)

Solutions

1. Read the wrapped error first — it identifies the failing subsystem (e.g. 'container runtime not found', 'failed to initialize eviction manager').
2. Verify the CRI socket: crictl --runtime-endpoint <endpoint> info.
3. Check KubeletConfiguration fields (evictionHard, imageGCHighThresholdPercent, etc.) for valid ranges.
4. Ensure kernel modules (overlay, br_netfilter) and cgroups are available.
5. Run kubelet with higher verbosity (--v=4) to trace which constructor failed.

Example fix

# before
--container-runtime-endpoint=unix:///run/containerd/containerd.sock
# containerd not running -> NewMainKubelet fails
# after: start runtime first, then kubelet
systemctl start containerd && systemctl start kubelet

// Hard to pre-validate fully; rely on kubelet --version dry checks.
// At least confirm the CRI endpoint answers:
func probeCRI(endpoint string) error {
    // run: crictl --runtime-endpoint <endpoint> info
    return runCrictl("info", endpoint)
}

k, err := createAndInitKubelet(ctx, kubeServer, kubeDeps, hostname, nodeName, nodeIPs)
if err != nil {
    return fmt.Errorf("failed to create kubelet: %w", err) // always inspect wrapped cause
}

When it happens

Trigger: Triggered whenever NewMainKubelet returns a non-nil error: unsupported container runtime endpoint, missing volume plugin, invalid eviction config, bad image GC settings, CAdvisor/cgroup init failure, or any of the many subsystem constructors erroring.

Common situations: Misconfigured container runtime (wrong --container-runtime-endpoint, CRI socket not running), invalid evictionHard thresholds, imageMinimumGCAge/cgroup incompatibility, missing kernel modules for the runtime, or a dependency injection bug in a custom kubelet build.

Related errors

• cannot exit on lock file contention: no lock file specified
• failed to set feature gates from initial flags-based config:
• failed to merge kubelet configs: %w
• failed to precedence kubeletConfigFlag: %w
• initialize logging: %v

AI-assisted analysis of kubernetes/kubernetes@b882c60b40 (2026-08-07). Data as JSON: /api/errors/0015d65da72b98c6. Report an issue: GitHub.