{"record":{"id":"33b92c04f4b54f5d","repo":"kubernetes/kubernetes","slug":"discovery-failed-for-clustertrustbundle-w","errorCode":null,"errorMessage":"discovery failed for ClusterTrustBundle: %w","messagePattern":"discovery failed for ClusterTrustBundle: %w","errorType":"console","errorClass":null,"httpStatus":null,"severity":"error","filePath":"cmd/kube-controller-manager/app/certificates.go","lineNumber":335,"sourceCode":"\t\tcertificatesv1alpha1.SchemeGroupVersion: ctbpublisher.NewAlphaClusterTrustBundlePublisher,\n\t\tcertificatesv1beta1.SchemeGroupVersion:  ctbpublisher.NewBetaClusterTrustBundlePublisher,\n\t\tcertificatesv1.SchemeGroupVersion:       ctbpublisher.NewGAClusterTrustBundlePublisher,\n\t}\n\n\tapiserverSignerClient, err := controllerContext.NewClient(\"kube-apiserver-serving-clustertrustbundle-publisher\")\n\tif err != nil {\n\t\treturn nil, err\n\t}\n\n\tvar runner ctbpublisher.PublisherRunner\n\tfor _, gv := range []schema.GroupVersion{\n\t\tcertificatesv1.SchemeGroupVersion,\n\t\tcertificatesv1beta1.SchemeGroupVersion,\n\t\tcertificatesv1alpha1.SchemeGroupVersion,\n\t} {\n\t\tctbAvailable, err := clusterTrustBundlesAvailable(apiserverSignerClient, gv)\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"discovery failed for ClusterTrustBundle: %w\", err)\n\t\t}\n\n\t\tif !ctbAvailable {\n\t\t\tcontinue\n\t\t}\n\n\t\trunner, err = schemaControllerMapping[gv](\n\t\t\t\"kubernetes.io/kube-apiserver-serving\",\n\t\t\tservingSigners,\n\t\t\tapiserverSignerClient,\n\t\t)\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"error creating kube-apiserver-serving signer certificates publisher: %w\", err)\n\t\t}\n\t\tbreak\n\t}\n\n\tif runner == nil {","sourceCodeStart":317,"sourceCodeEnd":353,"githubUrl":"https://github.com/kubernetes/kubernetes/blob/b882c60b4023bdf09264c2d5d30a2cadebc240fb/cmd/kube-controller-manager/app/certificates.go#L317-L353","documentation":"The kube-apiserver-serving ClusterTrustBundle publisher probes each certificates API group version (v1, v1beta1, v1alpha1) via discovery to find one that serves the 'clustertrustbundles' resource. clusterTrustBundlesAvailable calls ServerResourcesForGroupVersion; if it returns an error other than NotFound (which is handled), discovery is treated as failed and the controller aborts.","triggerScenarios":"certificates.go:333 calls clusterTrustBundlesAvailable(apiserverSignerClient, gv) which calls client.Discovery().ServerResourcesForGroupVersion(gv). It returns a non-nil, non-NotFound error (certificates.go:363-376) on a discovery transport error, an unexpected apiserver 5xx, auth failure, or a partial/nil resList with an error.","commonSituations":"Transient apiserver unavailability or throttling during controller-manager startup. RBAC denying discovery of certificates.k8s.io. Network/TLS blip to the apiserver. Aggregated apiserver/extension apiserver backing certificates.k8s.io returning errors. The ClusterTrustBundle feature gate enabled on a cluster whose apiserver is mid-rollout.","solutions":["Confirm apiserver discovery works: kubectl api-resources --api-group=certificates.k8s.io and kubectl get --raw=/apis/certificates.k8s.io/v1 (and v1beta1/v1alpha1).","Check apiserver health and logs for 5xx/throttling at startup; restart kube-controller-manager after apiserver is stable.","Verify the controller-manager's credentials/RBAC permit discovery of certificates.k8s.io.","If ClusterTrustBundle is not required, disable the feature gate (ClusterTrustBundle) so this publisher is not constructed."],"exampleFix":null,"handlingStrategy":"retry","validationCode":"# Pre-flight: confirm discovery of certificates.k8s.io works and CTB exists in some version.\nkubectl api-resources --api-group=certificates.k8s.io | grep -i clustertrustbundle || echo \"warn: no clustertrustbundles discovered in any version\"\nkubectl get --raw=/apis/certificates.k8s.io/v1 2>/dev/null | grep -i clustertrustbundle || true\n# Confirm RBAC permits discovery for the controller-manager's identity.","typeGuard":null,"tryCatchPattern":"// clusterTrustBundlesAvailable returns a transient error on transport/5xx failures;\n// NotFound is already handled (returns false,nil). Treat the non-NotFound error as\n// retryable: back off and re-run NewController* after the apiserver is stable.\nctbAvailable, err := clusterTrustBundlesAvailable(apiserverSignerClient, gv)\nif err != nil && !apierrors.IsNotFound(err) {\n    return nil, fmt.Errorf(\"discovery failed for ClusterTrustBundle: %w\", err)\n}","preventionTips":["Confirm apiserver discovery and RBAC for certificates.k8s.io before enabling the ClusterTrustBundle feature gate.","Start kube-controller-manager only after the apiserver is fully healthy.","If ClusterTrustBundle is not required, leave the feature gate off so this publisher is not constructed.","Use a process supervisor with restart-on-failure for transient discovery blips."],"tags":["certificates","clustertrustbundle","discovery","feature-gate","apiserver","kube-controller-manager"],"analyzedSha":"b882c60b4023bdf09264c2d5d30a2cadebc240fb","analyzedAt":"2026-08-07T04:07:48.144Z","schemaVersion":2},"datasetVersion":"2026-08-07T07:17:06.508Z"}