{"record":{"id":"225f6c8cc32c0daa","repo":"kubernetes/kubernetes","slug":"error-parsing-root-ca-file-at-s-w-225f6c","errorCode":null,"errorMessage":"error parsing root-ca-file at %s: %w","messagePattern":"error parsing root-ca-file at (.+?): %w","errorType":"console","errorClass":null,"httpStatus":null,"severity":"error","filePath":"cmd/kube-controller-manager/app/service_accounts.go","lineNumber":62,"sourceCode":"\nfunc newServiceAccountTokenController(\n\tctx context.Context, controllerContext ControllerContext, controllerName string,\n\trootClientBuilder clientbuilder.ControllerClientBuilder,\n) (Controller, error) {\n\tif len(controllerContext.ComponentConfig.SAController.ServiceAccountKeyFile) == 0 {\n\t\tklog.FromContext(ctx).Info(\"Controller is disabled because there is no private key\", \"controller\", controllerName)\n\t\treturn nil, nil\n\t}\n\n\tprivateKey, err := keyutil.PrivateKeyFromFile(controllerContext.ComponentConfig.SAController.ServiceAccountKeyFile)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"error reading key for service account token controller: %w\", err)\n\t}\n\n\tvar rootCA []byte\n\tif controllerContext.ComponentConfig.SAController.RootCAFile != \"\" {\n\t\tif rootCA, err = readCA(controllerContext.ComponentConfig.SAController.RootCAFile); err != nil {\n\t\t\treturn nil, fmt.Errorf(\"error parsing root-ca-file at %s: %w\", controllerContext.ComponentConfig.SAController.RootCAFile, err)\n\t\t}\n\t} else {\n\t\tconfig, err := rootClientBuilder.Config(\"tokens-controller\")\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"failed to create Kubernetes client config for %q: %w\", \"tokens-controller\", err)\n\t\t}\n\t\trootCA = config.CAData\n\t}\n\n\tclient, err := rootClientBuilder.Client(\"tokens-controller\")\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"failed to create Kubernetes client for %q: %w\", \"tokens-controller\", err)\n\t}\n\n\ttokenGenerator, err := serviceaccount.JWTTokenGenerator(serviceaccount.LegacyIssuer, privateKey)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"failed to build token generator: %w\", err)\n\t}","sourceCodeStart":44,"sourceCodeEnd":80,"githubUrl":"https://github.com/kubernetes/kubernetes/blob/b882c60b4023bdf09264c2d5d30a2cadebc240fb/cmd/kube-controller-manager/app/service_accounts.go#L44-L80","documentation":"Thrown in newServiceAccountTokenController (service_accounts.go:62) when readCA(RootCAFile) fails. The RootCAFile (--root-ca-file) is bundled into service-account token payloads so pods can trust the API server's serving cert; readCA parses it as a certificate bundle and fails on a missing/unreadable/malformed file. The %s is the configured path, %w the parse error.","triggerScenarios":"Starting KCM with --root-ca-file set to a path that does not exist, is unreadable, or does not contain valid PEM CA certificates. If the flag is empty the code falls back to the client config's CAData (line 64-69), so this error only fires when a path is explicitly provided but unreadable.","commonSituations":"Manifest references a CA bundle path that was never created or was rotated away; permissions on /etc/kubernetes/pki/ca.crt too strict; file accidentally contains a private key or CSR instead of a CA cert.","solutions":["Confirm the path exists and contains a valid PEM-encoded CA certificate bundle.","Fix permissions/ownership so the KCM process can read it.","If you have no dedicated root CA file, clear --root-ca-file to let KCM use the kubeconfig CAData fallback.","Regenerate/refresh the CA bundle from your PKI source."],"exampleFix":"# before: unreadable / wrong content\n--root-ca-file=/etc/kubernetes/pki/ca.key\n# after\n--root-ca-file=/etc/kubernetes/pki/ca.crt","handlingStrategy":"validation","validationCode":"if caPath := componentConfig.SAController.RootCAFile; caPath != \"\" {\n    if _, err := readCA(caPath); err != nil {\n        return fmt.Errorf(\"root-ca-file %s unreadable: %w\", caPath, err)\n    }\n}","typeGuard":null,"tryCatchPattern":"if rootCA, err = readCA(rootCAPath); err != nil {\n    return nil, fmt.Errorf(\"error parsing root-ca-file at %s: %w\", rootCAPath, err)\n}","preventionTips":["Point --root-ca-file at a valid PEM CA bundle only.","Omit the flag to use the kubeconfig CAData fallback if no dedicated CA file exists.","Check permissions/ownership of the CA file."],"tags":["kubernetes","go","kube-controller-manager","service-account","security","ca","certificates","configuration"],"analyzedSha":"b882c60b4023bdf09264c2d5d30a2cadebc240fb","analyzedAt":"2026-08-07T04:07:48.144Z","schemaVersion":2},"datasetVersion":"2026-08-07T07:17:06.508Z"}