{"record":{"id":"44ef6594ac2272f5","repo":"kubernetes/kops","slug":"keypair-service-account-task-not-found","errorCode":null,"errorMessage":"keypair/service-account task not found","messagePattern":"keypair/service-account task not found","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/model/issuerdiscovery.go","lineNumber":66,"sourceCode":"\tJWKSURI               string   `json:\"jwks_uri\"`\n\tAuthorizationEndpoint string   `json:\"authorization_endpoint\"`\n\tResponseTypes         []string `json:\"response_types_supported\"`\n\tSubjectTypes          []string `json:\"subject_types_supported\"`\n\tSigningAlgs           []string `json:\"id_token_signing_alg_values_supported\"`\n\tClaimsSupported       []string `json:\"claims_supported\"`\n}\n\nfunc (b *IssuerDiscoveryModelBuilder) Build(c *fi.CloudupModelBuilderContext) error {\n\tctx := context.TODO()\n\n\tserviceAccountIssuerDiscovery := b.Cluster.Spec.ServiceAccountIssuerDiscovery\n\tif serviceAccountIssuerDiscovery == nil || serviceAccountIssuerDiscovery.DiscoveryStore == \"\" {\n\t\treturn nil\n\t}\n\n\tsigningKeyTaskObject, found := c.Tasks[\"Keypair/service-account\"]\n\tif !found {\n\t\treturn fmt.Errorf(\"keypair/service-account task not found\")\n\t}\n\n\tskTask := signingKeyTaskObject.(*fitasks.Keypair)\n\n\tkeys := &OIDCKeys{\n\t\tSigningKey: skTask,\n\t}\n\n\tdiscovery, err := buildDiscoveryJSON(*b.Cluster.Spec.KubeAPIServer.ServiceAccountIssuer)\n\tif err != nil {\n\t\treturn err\n\t}\n\n\tvar publicFileACL *bool\n\n\tdiscoveryStorePath := b.Cluster.Spec.ServiceAccountIssuerDiscovery.DiscoveryStore\n\tdiscoveryStore, err := vfs.Context.BuildVfsPath(discoveryStorePath)\n\tif err != nil {","sourceCodeStart":48,"sourceCodeEnd":84,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/pkg/model/issuerdiscovery.go#L48-L84","documentation":"During cluster model building, IssuerDiscoveryModelBuilder.Build publishes OIDC issuer discovery files, but the JWKS content depends on the service-account signing key task ('Keypair/service-account'). If that task was not registered in the model builder context, kops cannot reference the signing key and aborts with this error. It indicates an internal model-builder ordering/registration problem rather than user configuration alone.","triggerScenarios":"Running `kops update cluster` with cluster.spec.serviceAccountIssuerDiscovery.discoveryStore set, while the Keypair/service-account task is absent from the task map — typically because the keypair model builder did not run or was filtered out by lifecycle/phase selection.","commonSituations":"Custom kops builds with modified model builders, running a partial/targeted model build that skips the keypair builder, or a version/patch regression in kops where the service-account keypair task is no longer added before the issuer-discovery builder executes.","solutions":["Ensure the cluster spec enables the service-account keypair (do not set kubeAPIServer.serviceAccountKey or related overrides that suppress the default keypair generation).","Run a full `kops update cluster` (not a narrowed builder phase) so the keypair model builder registers the task before IssuerDiscoveryModelBuilder.","Upgrade or rebuild kops from a released version; this is an internal task-registration bug if reproducible on stock kops.","File a kops issue with the full cluster spec and `--v=10` logs if the error persists on unmodified kops."],"exampleFix":"// before (custom builder skipping keypair task)\nc.AddTask(&fitasks.Keypair{Name: fi.ValueOf(\"apiserver\")})\n// after\nc.AddTask(&fitasks.Keypair{Name: fi.ValueOf(\"apiserver\")})\nc.AddTask(&fitasks.Keypair{Name: fi.ValueOf(\"service-account\")})","handlingStrategy":"validation","validationCode":"// Validate the cluster spec and environment before running kops update:\nspec := cluster.Spec\nif spec.ServiceAccountIssuerDiscovery != nil && spec.ServiceAccountIssuerDiscovery.DiscoveryStore != \"\" {\n    if spec.KubeAPIServer == nil || spec.KubeAPIServer.ServiceAccountIssuer == nil || *spec.KubeAPIServer.ServiceAccountIssuer == \"\" {\n        return fmt.Errorf(\"serviceAccountIssuerDiscovery requires kubeAPIServer.serviceAccountIssuer to be set\")\n    }\n    // run a full `kops update cluster` so the Keypair/service-account task is registered\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Always run the complete `kops update cluster` flow, never a narrowed/partial builder phase.","Set both serviceAccountIssuerDiscovery.discoveryStore and kubeAPIServer.serviceAccountIssuer together.","Keep kops on an official release; this error on stock kops indicates a bug worth reporting.","Grep cluster yaml for overrides (serviceAccountKey) that can suppress keypair generation."],"tags":["kops","oidc","model-builder","internal-error"],"backgroundTag":"missing-dependency-task","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T07:17:12.445Z"}