{"record":{"id":"2c5010390f6dbcb0","repo":"kubernetes/kubernetes","slug":"failed-to-init-kubernetes-io-legacy-unknown-certif","errorCode":null,"errorMessage":"failed to init kubernetes.io/legacy-unknown certificate controller: %w","messagePattern":"failed to init kubernetes\\.io/legacy-unknown certificate controller: %w","errorType":"console","errorClass":null,"httpStatus":null,"severity":"error","filePath":"cmd/kube-controller-manager/app/certificates.go","lineNumber":117,"sourceCode":"\t}\n\n\tif kubeAPIServerSignerCertFile, kubeAPIServerSignerKeyFile := getKubeAPIServerClientSignerFiles(controllerContext.ComponentConfig.CSRSigningController); len(kubeAPIServerSignerCertFile) > 0 || len(kubeAPIServerSignerKeyFile) > 0 {\n\t\tkubeAPIServerClientSigner, err := signer.NewKubeAPIServerClientCSRSigningController(ctx, c, csrInformer, kubeAPIServerSignerCertFile, kubeAPIServerSignerKeyFile, certTTL)\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"failed to init kubernetes.io/kube-apiserver-client certificate controller: %w\", err)\n\t\t}\n\n\t\trx = append(rx, func(ctx context.Context) {\n\t\t\tkubeAPIServerClientSigner.Run(ctx, 5)\n\t\t})\n\t} else {\n\t\tlogger.Info(\"Skipping CSR signer controller because specific files were specified for other signers and not this one\", \"controller\", \"kubernetes.io/kube-apiserver-client\")\n\t}\n\n\tif legacyUnknownSignerCertFile, legacyUnknownSignerKeyFile := getLegacyUnknownSignerFiles(controllerContext.ComponentConfig.CSRSigningController); len(legacyUnknownSignerCertFile) > 0 || len(legacyUnknownSignerKeyFile) > 0 {\n\t\tlegacyUnknownSigner, err := signer.NewLegacyUnknownCSRSigningController(ctx, c, csrInformer, legacyUnknownSignerCertFile, legacyUnknownSignerKeyFile, certTTL)\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"failed to init kubernetes.io/legacy-unknown certificate controller: %w\", err)\n\t\t}\n\n\t\trx = append(rx, func(ctx context.Context) {\n\t\t\tlegacyUnknownSigner.Run(ctx, 5)\n\t\t})\n\t} else {\n\t\tlogger.Info(\"Skipping CSR signer controller because specific files were specified for other signers and not this one\", \"controller\", \"kubernetes.io/legacy-unknown\")\n\t}\n\n\treturn newControllerLoop(concurrentRun(rx...), controllerName), nil\n}\n\nfunc areKubeletServingSignerFilesSpecified(config csrsigningconfig.CSRSigningControllerConfiguration) bool {\n\t// if only one is specified, it will error later during construction\n\treturn len(config.KubeletServingSignerConfiguration.CertFile) > 0 || len(config.KubeletServingSignerConfiguration.KeyFile) > 0\n}\nfunc areKubeletClientSignerFilesSpecified(config csrsigningconfig.CSRSigningControllerConfiguration) bool {\n\t// if only one is specified, it will error later during construction","sourceCodeStart":99,"sourceCodeEnd":135,"githubUrl":"https://github.com/kubernetes/kubernetes/blob/b882c60b4023bdf09264c2d5d30a2cadebc240fb/cmd/kube-controller-manager/app/certificates.go#L99-L135","documentation":"When the legacy-unknown signer files are configured, signer.NewLegacyUnknownCSRSigningController builds the signer that signs CSRs of type kubernetes.io/legacy-unknown. A returned error aborts construction of the CSR signing controller.","triggerScenarios":"certificates.go:115 calls signer.NewLegacyUnknownCSRSigningController(ctx, c, csrInformer, certFile, keyFile, certTTL). It errors when the cert/key pair cannot be loaded/parsed, the pair does not match, or the files are unreadable.","commonSituations":"Misconfigured --cluster-signing-legacy-unknown-cert-file/--cluster-signing-legacy-unknown-key-file (or default pair) with missing/unreadable/mismatched files. The legacy-unknown signer is largely deprecated, so misconfiguration often comes from stale guides. PEM corruption, permission errors.","solutions":["Verify the legacy-unknown signing cert and key files exist and are readable.","Confirm the cert/key pair matches (compare modulus).","Read the wrapped %w for the specific TLS error.","Consider whether you need the legacy-unknown signer at all (deprecated); remove its flags if unused."],"exampleFix":null,"handlingStrategy":"validation","validationCode":"# Pre-flight: validate the legacy-unknown signing pair (and consider removing it).\nCERT=/etc/kubernetes/pki/legacy-unknown-ca.crt  # --cluster-signing-legacy-unknown-cert-file\nKEY=/etc/kubernetes/pki/legacy-unknown-ca.key   # --cluster-signing-legacy-unknown-key-file\nopenssl x509 -in \"$CERT\" -noout >/dev/null 2>&1 || { echo \"bad cert\" >&2; exit 1; }\nopenssl rsa  -in \"$KEY\"  -noout >/dev/null 2>&1 || { echo \"bad key\" >&2; exit 1; }\n[ \"$(openssl x509 -in \"$CERT\" -noout -modulus | openssl md5)\" = \"$(openssl rsa -in \"$KEY\" -noout -modulus | openssl md5)\" ] \\\n  || { echo \"cert/key mismatch\" >&2; exit 1; }","typeGuard":null,"tryCatchPattern":"signer, err := signer.NewLegacyUnknownCSRSigningController(ctx, c, csrInformer, certFile, keyFile, certTTL)\nif err != nil {\n    return nil, fmt.Errorf(\"failed to init kubernetes.io/legacy-unknown certificate controller: %w\", err)\n}","preventionTips":["The legacy-unknown signer is deprecated; remove its flags unless explicitly needed.","Deploy cert and key as an atomic pair with a modulus compare.","Keep file permissions correct for the controller-manager uid."],"tags":["certificates","csr","signing","legacy-unknown","tls","kube-controller-manager"],"analyzedSha":"b882c60b4023bdf09264c2d5d30a2cadebc240fb","analyzedAt":"2026-08-07T04:07:48.144Z","schemaVersion":2},"datasetVersion":"2026-08-07T07:17:06.508Z"}