{"record":{"id":"2788d2bd624cb808","repo":"kubernetes/kops","slug":"error-reading-user-provided-cert-q-v","errorCode":null,"errorMessage":"error reading user provided cert %q: %v","messagePattern":"error reading user provided cert %q: (.+?)","errorType":"console","errorClass":null,"httpStatus":null,"severity":"error","filePath":"cmd/kops/create_keypair.go","lineNumber":226,"sourceCode":"\t\t\t}\n\t\t}\n\n\t\tserial := pki.BuildPKISerial(time.Now().UnixNano())\n\t\treq := pki.IssueCertRequest{\n\t\t\tType:       \"ca\",\n\t\t\tSubject:    pkix.Name{CommonName: name, SerialNumber: serial.String()},\n\t\t\tSerial:     serial,\n\t\t\tPrivateKey: privateKey,\n\t\t}\n\t\tcert, _, _, err = pki.IssueCert(ctx, &req, nil)\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"error issuing certificate: %v\", err)\n\t\t}\n\t} else {\n\t\toptions.CertPath = utils.ExpandPath(options.CertPath)\n\t\tcertBytes, err := os.ReadFile(options.CertPath)\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"error reading user provided cert %q: %v\", options.CertPath, err)\n\t\t}\n\n\t\tcert, err = pki.ParsePEMCertificate(certBytes)\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"error loading certificate %q: %v\", options.CertPath, err)\n\t\t}\n\t}\n\n\tkeyset, err := keyStore.FindKeyset(ctx, name)\n\tvar item *fi.KeysetItem\n\tif os.IsNotExist(err) || (err == nil && keyset == nil) {\n\t\tif options.Primary {\n\t\t\tif keyset, err = fi.NewKeyset(cert, privateKey); err != nil {\n\t\t\t\treturn err\n\t\t\t}\n\t\t} else {\n\t\t\treturn fmt.Errorf(\"the first keypair added to a keyset must be primary\")\n\t\t}","sourceCodeStart":208,"sourceCodeEnd":244,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/cmd/kops/create_keypair.go#L208-L244","documentation":"This error occurs when the certificate file passed with --cert to `kops create keypair` cannot be read from disk. os.ReadFile fails, typically because the path is wrong, unreadable, or missing. The path is expanded from ~ before reading.","triggerScenarios":"Running `kops create keypair <cluster> <keyset> --cert <path>` where <path> does not exist, has a typo, points to a directory, or the process lacks read permission.","commonSituations":"Relative path executed from the wrong working directory; file never copied to the host; wrong ~ expansion; read permissions blocked by secrets-management mounts.","solutions":["Verify the file exists: ls -l <certPath>.","Use an absolute path or confirm ~ expansion resolves to the intended file.","Check read permissions for the user running kOps.","Re-copy/export the certificate if it is missing."],"exampleFix":"// before\nkops create keypair cluster.name kubernetes-ca --cert ./ca.crt\n// error: open ./ca.crt: no such file or directory\n// after\nkops create keypair cluster.name kubernetes-ca --cert /etc/pki/ca.crt","handlingStrategy":"validation","validationCode":"fi, err := os.Stat(certPath)\nif err != nil {\n    return fmt.Errorf(\"cert file not accessible: %w\", err)\n}\nif fi.IsDir() {\n    return errors.New(\"cert path is a directory, not a file\")\n}","typeGuard":null,"tryCatchPattern":"if err != nil && strings.Contains(err.Error(), \"error reading user provided cert\") {\n    // surface the wrapped os error and the expanded path to the user\n}","preventionTips":["Always pass absolute paths to --cert.","Check file existence/permissions before invoking kOps.","Avoid read-only 0000-permission mounts for certs in containers."],"tags":["file-io","certificate","cli"],"backgroundTag":"file-not-found","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T07:17:12.445Z"}