{"record":{"id":"035b89a04dfe2b2f","repo":"kubernetes/kops","slug":"unable-to-issue-certificate-v","errorCode":null,"errorMessage":"unable to issue certificate: %v","messagePattern":"unable to issue certificate: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/commands/helpers/kubectl_auth.go","lineNumber":268,"sourceCode":"\tif err != nil || user == nil {\n\t\tklog.Infof(\"unable to get user: %v\", err)\n\t} else {\n\t\tcn += \"-\" + user.Name\n\t}\n\n\treq := pki.IssueCertRequest{\n\t\tSigner: fi.CertificateIDCA,\n\t\tType:   \"client\",\n\t\tSubject: pkix.Name{\n\t\t\tCommonName: cn,\n\n\t\t\tOrganization: []string{rbac.SystemPrivilegedGroup},\n\t\t},\n\t\tValidity: options.Lifetime,\n\t}\n\tcert, privateKey, _, err := pki.IssueCert(ctx, &req, fi.NewPKIKeystoreAdapter(keyStore))\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"unable to issue certificate: %v\", err)\n\t}\n\n\tstatus := &ExecCredentialStatus{}\n\tstatus.ClientCertificateData, err = cert.AsString()\n\tif err != nil {\n\t\treturn nil, err\n\t}\n\tstatus.ClientKeyData, err = privateKey.AsString()\n\tif err != nil {\n\t\treturn nil, err\n\t}\n\n\t// Subtract a few minutes from the validity for clock skew\n\tstatus.ExpirationTimestamp = cert.Certificate.NotAfter.Add(-5 * time.Minute)\n\n\treturn status, nil\n}\n","sourceCodeStart":250,"sourceCodeEnd":286,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/pkg/commands/helpers/kubectl_auth.go#L250-L286","documentation":"buildCredentials asks pki.IssueCert to sign a new client certificate (CN kubecfg-<user>, in the system:masters group) using the cluster CA from the key store. If signing fails — missing CA key, decrypt errors, or key-store read failures — the error is wrapped as 'unable to issue certificate'. Without a fresh cert the helper cannot produce the ExecCredential kubectl needs.","triggerScenarios":"pki.IssueCert fails because the cluster CA key cannot be read/decrypted from the key store: CA key encrypted with an unavailable KMS key, keycloak/vault backend down, missing permissions on kops-ca secret, or CA key absent from the state store.","commonSituations":"Clusters using KMS/vault-encrypted CA keys where the operator lacks decrypt permissions; kubectl-auth run from a machine/container without state-store secret access; rotated or lost kops-ca key material; clock skew affecting validity windows.","solutions":["Confirm access to the cluster CA secret: try `kops get secrets kops-ca --cluster <name>` and fix IAM/KMS permissions if it fails.","If the CA key is KMS/vault-encrypted, ensure the runtime can decrypt it (correct AWS_KMS / vault credentials).","Restore or re-create the kops-ca key pair if it is missing, then re-run; as a last resort re-issue cluster certs via `kops toolbox pki` or cluster re-export."],"exampleFix":"// before\n$ kops helpers kubectl-auth --cluster c  # KMS decrypt denied\n// after\n$ aws kms grant ... / attach a policy allowing kms:Decrypt for the CA key\n$ kops helpers kubectl-auth --cluster c","handlingStrategy":"retry","validationCode":"// verify CA secret access before invoking the helper\nif err := exec.Command(\"kops\", \"get\", \"secrets\", \"kops-ca\", \"--cluster\", clusterName).Run(); err != nil {\n    return fmt.Errorf(\"cannot access cluster CA keystore: %v\", err)\n}","typeGuard":null,"tryCatchPattern":"err := helpers.RunKubectlAuthHelper(ctx, f, out, options)\nif err != nil && strings.Contains(err.Error(), \"unable to issue certificate\") {\n    if isTransientKmsOrVaultError(err) {\n        time.Sleep(2 * time.Second)\n        err = helpers.RunKubectlAuthHelper(ctx, f, out, options)\n    }\n}","preventionTips":["Grant kms:Decrypt / vault read permissions to identities running the auth helper.","Keep the kops-ca key pair intact in the state store; test issuance with `kops toolbox pki` after rotation.","Run the helper from hosts with reliable access to cluster secrets (CI runners, admin workstations)."],"tags":["pki","certificate","keystore"],"backgroundTag":"certificate-issuance-failed","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T07:17:12.445Z"}