{"record":{"id":"29901ba3adf9eb32","repo":"kubernetes/kops","slug":"encoding-service-account-keys-w","errorCode":null,"errorMessage":"encoding service-account keys: %w","messagePattern":"encoding service-account keys: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/nodemodel/nodeupconfigbuilder.go","lineNumber":277,"sourceCode":"\t\t\t\tconfig.KeypairIDs[\"etcd-client-cilium\"] = keysets[\"etcd-client-cilium\"].Primary.Id\n\t\t\t}\n\t\t}\n\n\t\tif hasAPIServer {\n\t\t\tif err := loadCertificates(keysets, \"apiserver-aggregator-ca\", config, true); err != nil {\n\t\t\t\treturn nil, nil, err\n\t\t\t}\n\t\t\tif keysets[\"etcd-clients-ca\"] != nil {\n\t\t\t\tif err := loadCertificates(keysets, \"etcd-clients-ca\", config, true); err != nil {\n\t\t\t\t\treturn nil, nil, err\n\t\t\t\t}\n\t\t\t}\n\t\t\tconfig.KeypairIDs[\"service-account\"] = keysets[\"service-account\"].Primary.Id\n\n\t\t\tconfig.APIServerConfig.EncryptionConfigSecretHash = n.encryptionConfigSecretHash\n\t\t\tserviceAccountPublicKeys, err := keysets[\"service-account\"].ToPublicKeys()\n\t\t\tif err != nil {\n\t\t\t\treturn nil, nil, fmt.Errorf(\"encoding service-account keys: %w\", err)\n\t\t\t}\n\t\t\tconfig.APIServerConfig.ServiceAccountPublicKeys = serviceAccountPublicKeys\n\t\t} else {\n\t\t\tfor _, key := range []string{\"kubelet\", \"kube-proxy\", \"kube-router\"} {\n\t\t\t\tif keysets[key] != nil {\n\t\t\t\t\tconfig.KeypairIDs[key] = keysets[key].Primary.Id\n\t\t\t\t}\n\t\t\t}\n\t\t}\n\t}\n\n\tif hasAPIServer {\n\t\tconfig.ApiserverAdditionalIPs = wellKnownAddresses[wellknownservices.KubeAPIServer]\n\t}\n\n\t// Set API server address to an IP from the cluster network CIDR\n\tcontrolPlaneIPs, err := selectControlPlaneIPs(cluster, wellKnownAddresses[wellknownservices.KubeAPIServer])\n\tif err != nil {","sourceCodeStart":259,"sourceCodeEnd":295,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/pkg/nodemodel/nodeupconfigbuilder.go#L259-L295","documentation":"When building config for an API-server group, the service-account keyset must be encoded to public keys for the API server config. If keysets['service-account'].ToPublicKeys() fails (missing or malformed key material), this error wraps the cause.","triggerScenarios":"BuildConfig runs on a control-plane/API-server instance group where the 'service-account' keyset exists but its primary key cannot be serialized to public keys (corrupt/absent key data in the keystore).","commonSituations":"Keyset store (e.g. in the state store) missing the private/primary service-account key; keys created by a different kOps version with incompatible format; interrupted key rotation leaving an empty primary.","solutions":["Inspect the wrapped cause; re-create the service-account keyset with 'kops update cluster' or keyset tooling (kops toolbox pki / get keyset)","Restore the service-account keyset from a backup of the state store if keys were lost","Run a cluster rolling-update after fixing keys so nodes pick up the corrected keyset"],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":"sa := keysets[\"service-account\"]\nif sa == nil || sa.Primary == nil || sa.Primary.Id == \"\" {\n    return fmt.Errorf(\"service-account keyset missing or has no primary\")\n}","typeGuard":null,"tryCatchPattern":"pub, err := keysets[\"service-account\"].ToPublicKeys()\nif err != nil {\n    // re-create keyset from state store backup, then retry\n    return fmt.Errorf(\"encoding service-account keys: %w\", err)\n}","preventionTips":["Back up the state store keysets before key rotations","Verify keyset integrity with kops get keyset secrets after rotations","Use one kOps version for all key creation and consumption","Re-run kops update cluster if the primary key looks stale"],"tags":["keystore","service-account","keys","nodeup"],"backgroundTag":"keyset-encoding-failed","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T12:17:11.808Z"}