{"record":{"id":"14b1359840209c70","repo":"kubernetes/kops","slug":"certificate-q-not-found","errorCode":null,"errorMessage":"certificate %q not found","messagePattern":"certificate %q not found","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"nodeup/pkg/model/context.go","lineNumber":408,"sourceCode":"\t}\n\n\tkeyset, err := c.KeyStore.FindKeyset(ctx.Context(), name)\n\tif err != nil {\n\t\treturn err\n\t}\n\tif keyset == nil {\n\t\treturn fmt.Errorf(\"keyset %q not found\", name)\n\t}\n\n\titem := keyset.Items[keypairID]\n\tif item == nil {\n\t\treturn fmt.Errorf(\"did not find keypair %s for %s\", keypairID, name)\n\t}\n\n\tif includeCert {\n\t\tcertificate := item.Certificate\n\t\tif certificate == nil {\n\t\t\treturn fmt.Errorf(\"certificate %q not found\", name)\n\t\t}\n\n\t\tcert, err := certificate.AsString()\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\n\t\tctx.AddTask(&nodetasks.File{\n\t\t\tPath:           p + \".crt\",\n\t\t\tContents:       fi.NewStringResource(cert),\n\t\t\tType:           nodetasks.FileType_File,\n\t\t\tMode:           s(\"0600\"),\n\t\t\tOwner:          owner,\n\t\t\tBeforeServices: beforeServices,\n\t\t})\n\t}\n\n\tprivateKey := item.PrivateKey","sourceCodeStart":390,"sourceCodeEnd":426,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/nodeup/pkg/model/context.go#L390-L426","documentation":"The keyset item for the requested keypair ID exists but has no Certificate part, so buildCertificatePairTask cannot serialize the .crt file. This indicates an incomplete/corrupt keypair entry in the keystore.","triggerScenarios":"item.Certificate is nil for the requested keypair in BuildCertificatePairTask/Build — e.g. the keyset stores only a private key (created via BuildPrivateKeyTask-style flows or manual state-store edits), or the certificate portion failed to persist.","commonSituations":"Manually patched state store objects; keystore backends where a write of cert succeeded but key failed (or vice versa) leaving a partial item; importing keypairs without a certificate.","solutions":["Inspect the keyset item: `kops get keypairs <name> -o yaml` to confirm the certificate field is empty","Re-issue the keypair: `kops create keypair <name>` to regenerate a full cert+key item and update nodes","Restore the complete keypair from a state-store backup","If a custom tool wrote the keyset, ensure it stores both Certificate and PrivateKey in the item"],"exampleFix":null,"handlingStrategy":"validation","validationCode":"item := keyset.Items[keypairID]\nif item == nil || item.Certificate == nil {\n    return fmt.Errorf(\"keypair %s/%s incomplete (no certificate); run 'kops create keypair %s'\", name, keypairID, name)\n}","typeGuard":null,"tryCatchPattern":"if err := c.BuildCertificatePairTask(ctx, name, path, filename, owner, nil); err != nil {\n    if strings.Contains(err.Error(), \"certificate\") && strings.Contains(err.Error(), \"not found\") {\n        // re-issue the keypair and retry\n    }\n    return err\n}","preventionTips":["Never hand-edit keyset objects in the state store","Validate keysets with `kops get keypairs -o yaml` after any state-store restore","Always create keypairs via kops tooling so cert+key persist together","Test state-store restores in a staging cluster"],"tags":["go","nodeup","certificate","keystore"],"backgroundTag":"incomplete-keypair","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T07:17:12.445Z"}