{"record":{"id":"2c8ec677a0e874cb","repo":"kubernetes/kops","slug":"error-reading-certificate-q-v","errorCode":null,"errorMessage":"error reading certificate %q: %v","messagePattern":"error reading certificate %q: (.+?)","errorType":"console","errorClass":null,"httpStatus":null,"severity":"critical","filePath":"cmd/kube-apiserver-healthcheck/main.go","lineNumber":156,"sourceCode":"\tflag.StringVar(&clientCert, \"client-cert\", clientCert, \"path to client certificate\")\n\tflag.StringVar(&clientKey, \"client-key\", clientKey, \"path to client key\")\n\tflag.StringVar(&caCert, \"ca-cert\", caCert, \"path to ca certificate\")\n\n\tklog.InitFlags(nil)\n\t// Opt into the new klog behavior so that -stderrthreshold is honored even\n\t// when -logtostderr=true (the default).\n\t// Ref: kubernetes/klog#212, kubernetes/klog#432\n\tflag.Set(\"legacy_stderr_threshold_behavior\", \"false\") //nolint:errcheck\n\tflag.Set(\"stderrthreshold\", \"INFO\")                   //nolint:errcheck\n\n\tflag.Parse()\n\n\ttlsConfig := &tls.Config{}\n\n\tif caCert != \"\" {\n\t\tb, err := os.ReadFile(caCert)\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"error reading certificate %q: %v\", caCert, err)\n\t\t}\n\t\trootCAs := x509.NewCertPool()\n\t\trootCAs.AppendCertsFromPEM(b)\n\t\ttlsConfig.RootCAs = rootCAs\n\t}\n\n\tif clientKey != \"\" {\n\t\tkeypair, err := tls.LoadX509KeyPair(clientCert, clientKey)\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"error reading client keypair: %v\", err)\n\t\t}\n\n\t\ttlsConfig.Certificates = []tls.Certificate{keypair}\n\t}\n\n\ttransport := &http.Transport{\n\t\tTLSClientConfig: tlsConfig,\n\t}","sourceCodeStart":138,"sourceCodeEnd":174,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/cmd/kube-apiserver-healthcheck/main.go#L138-L174","documentation":"The kube-apiserver-healthcheck sidecar fails in run() when os.ReadFile cannot read the CA certificate file given by --ca-cert. Without the CA bundle the healthcheck cannot build its x509 root pool to trust the API server. The check aborts before serving health endpoints.","triggerScenarios":"The path in --ca-cert does not exist, is unreadable (permissions), is a dangling symlink/misconfigured mount, or the secret volume is not yet mounted when the sidecar starts.","commonSituations":"Kubernetes secret volume not mounted into the sidecar pod; wrong path flag; file deleted or permissions changed by a security policy; manifest templating error leaving a placeholder path.","solutions":["Verify the CA cert file exists and is readable at the given path (ls -l / cat the file).","Fix the --ca-cert flag or the secret volumeMount in the pod manifest.","Ensure the secret containing the CA exists in the pod's namespace.","Restart the sidecar after the volume is mounted, or add an init wait for the file."],"exampleFix":"// before\nrun(\"--ca-cert\", \"/etc/missing/ca.crt\", ...)\n// after\nrun(\"--ca-cert\", \"/etc/kubernetes/pki/ca.crt\", ...)","handlingStrategy":"validation","validationCode":"// before starting the healthcheck\nif _, err := os.Stat(caCertPath); err != nil {\n    return fmt.Errorf(\"CA cert unavailable at %s: %w\", caCertPath, err)\n}\nif _, err := os.ReadFile(caCertPath); err != nil {\n    return err\n}","typeGuard":null,"tryCatchPattern":"// Go: wrap and fail fast at startup\nif err := run(); err != nil {\n    klog.Fatalf(\"healthcheck terminated: %v\", err)\n}","preventionTips":["Mount CA secrets as volumes and verify volumeMount paths in the pod spec.","Validate flag paths with an init container or startup preflight.","Keep cert paths versioned with the manifest, not hardcoded guesses.","Set readiness probes so the sidecar restarts if certs vanish."],"tags":["tls","certificates","healthcheck","file-io"],"backgroundTag":"certificate-file-not-found","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T07:17:12.445Z"}