{"record":{"id":"049288e220a675d2","repo":"kubernetes/kops","slug":"error-setting-resources-v","errorCode":null,"errorMessage":"error setting resources: %v","messagePattern":"error setting resources: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"upup/pkg/fi/fitasks/keypair.go","lineNumber":115,"sourceCode":"\t}\n\tsort.Strings(alternateNames)\n\n\tactual := &Keypair{\n\t\tName:           &name,\n\t\tAlternateNames: alternateNames,\n\t\tSubject:        pki.PkixNameToString(&cert.Subject),\n\t\tIssuer:         pki.PkixNameToString(&cert.Certificate.Issuer),\n\t\tType:           pki.BuildTypeDescription(cert.Certificate),\n\t\tLegacyFormat:   keyset.LegacyFormat,\n\t}\n\n\tactual.Signer = &Keypair{Subject: pki.PkixNameToString(&cert.Certificate.Issuer)}\n\n\t// Avoid spurious changes\n\tactual.Lifecycle = e.Lifecycle\n\n\tif err := e.setResources(keyset); err != nil {\n\t\treturn nil, fmt.Errorf(\"error setting resources: %v\", err)\n\t}\n\n\treturn actual, nil\n}\n\nfunc (e *Keypair) Run(c *fi.CloudupContext) error {\n\treturn fi.CloudupDefaultDeltaRunMethod(e, c)\n}\n\nfunc (e *Keypair) Normalize(c *fi.CloudupContext) error {\n\tvar alternateNames []string\n\n\tfor _, s := range e.AlternateNames {\n\t\ts = strings.TrimSpace(s)\n\t\tif s == \"\" {\n\t\t\tcontinue\n\t\t}\n\t\talternateNames = append(alternateNames, s)","sourceCodeStart":97,"sourceCodeEnd":133,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/upup/pkg/fi/fitasks/keypair.go#L97-L133","documentation":"After Find successfully loads a keypair's keyset from the keystore, kops calls setResources to serialize the keyset into certificate resources attached to the task. If serialization (keyset.ToCertificateBytes) fails, the error is wrapped as 'error setting resources'. This indicates the stored keyset data is malformed or cannot be encoded, not a missing entry.","triggerScenarios":"Find on an existing keypair where keyset.ToCertificateBytes() returns an error — corrupted/invalid PEM data in the stored keyset, or an unsupported/legacy keyset layout that fails to serialize.","commonSituations":"State store contents manually edited or truncated; keyset written by an older kOps version with a legacy format that no longer parses; corruption during S3/GCS sync or partial upload.","solutions":["Restore the keyset files for <name> from backup in the state store","Rotate the keypair: delete it via `kops delete secret keypair <name>` and re-run `kops update cluster --yes`","Inspect the stored keyset (cert/key PEM) for truncation or invalid base64/PEM","Upgrade/align kOps versions between the writer and reader of the state store"],"exampleFix":"// before: truncated PEM in state store for keyset 'apiserver'\n// after\nkops delete secret keypair apiserver --name mycluster.example.com\nkops update cluster --yes","handlingStrategy":"validation","validationCode":"if _, err := keyset.ToCertificateBytes(); err != nil { return fmt.Errorf(\"keyset %q fails serialization: %v\", name, err) }","typeGuard":null,"tryCatchPattern":"if err != nil { if strings.Contains(err.Error(), \"setting resources\") { // rotate the affected keypair via kops delete secret keypair } return err }","preventionTips":["Avoid manual edits of state-store keyset files","Keep writer and reader kOps versions consistent","Verify PEM integrity of keysets after state-store migrations"],"tags":["pki","keystore","serialization"],"backgroundTag":"keystore-corruption","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T07:17:12.445Z"}