{"record":{"id":"472873f0fe971c26","repo":"kubernetes/kops","slug":"error-finding-discovery-ca-w","errorCode":null,"errorMessage":"error finding discovery CA: %w","messagePattern":"error finding discovery CA: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"upup/pkg/fi/cloudup/new_cluster.go","lineNumber":1779,"sourceCode":"\t\t\tcase ec2types.ArchitectureTypeArm64:\n\t\t\t\treturn architectures.ArchitectureArm64, nil\n\t\t\tdefault:\n\t\t\t\tunsupported = append(unsupported, arch)\n\t\t\t}\n\t\t}\n\t\treturn \"\", fmt.Errorf(\"unsupported architecture for instance type %q: %v\", machineType, unsupported)\n\tdefault:\n\t\t// No other clouds are known to support any other architectures at this time\n\t\treturn architectures.ArchitectureAmd64, nil\n\t}\n}\n\n// discoveryUniverseID returns the universe ID for the cluster's discovery service,\n// creating a new discovery CA if necessary.\nfunc discoveryUniverseID(ctx context.Context, keystore fi.Keystore) (string, error) {\n\tkeyset, err := keystore.FindKeyset(ctx, fi.DiscoveryCAID)\n\tif err != nil {\n\t\treturn \"\", fmt.Errorf(\"error finding discovery CA: %w\", err)\n\t}\n\n\tif keyset == nil || keyset.Primary == nil || keyset.Primary.Certificate == nil {\n\t\tsubject := pkix.Name{\n\t\t\tCommonName: fi.DiscoveryCAID,\n\t\t}\n\t\tkeyset, err = fitasks.CreateKeyset(ctx, keystore, fi.DiscoveryCAID, pki.IssueCertRequest{\n\t\t\tSubject: subject,\n\t\t\tType:    \"ca\",\n\t\t})\n\t\tif err != nil {\n\t\t\treturn \"\", fmt.Errorf(\"error creating discovery CA: %w\", err)\n\t\t}\n\t}\n\n\tif keyset == nil || keyset.Primary == nil || keyset.Primary.Certificate == nil || keyset.Primary.Certificate.Certificate == nil {\n\t\treturn \"\", fmt.Errorf(\"discovery CA creation failed\")\n\t}","sourceCodeStart":1761,"sourceCodeEnd":1797,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/upup/pkg/fi/cloudup/new_cluster.go#L1761-L1797","documentation":"discoveryUniverseID reads the cluster's discovery CA keyset (fi.DiscoveryCAID) from the keystore; if the keyset lookup call itself errors, this wrapped error is returned. It signals a keystore/backend failure while reading cluster discovery state, distinct from the CA simply not existing.","triggerScenarios":"Cluster creation/upgrade path that calls discoveryUniverseID when the keystore backend (e.g. S3/OSS/state store) returns an error on FindKeyset: backend unreachable, permission denied, corrupted state-store object.","commonSituations":"State store bucket permissions changed; network outage to the state store; partially deleted or corrupted cluster state.","solutions":["Verify state-store access (credentials, bucket permissions, network)","Inspect the keystore object for the discovery CA in the state store and repair/restore if corrupted","Retry the operation if the backend error was transient"],"exampleFix":null,"handlingStrategy":"retry","validationCode":"// pre-check state-store reachability/permissions\nif err := checkStateStoreAccess(stateStore); err != nil {\n    return err\n}","typeGuard":null,"tryCatchPattern":"keyset, err := keystore.FindKeyset(ctx, fi.DiscoveryCAID)\nif err != nil {\n    if isTransient(err) {\n        // retry with backoff\n    }\n    return fmt.Errorf(\"keystore unavailable: %w\", err)\n}","preventionTips":["Monitor state-store permissions in CI","Test state-store connectivity before kops runs","Backup the keystore path"],"tags":["keystore","pki","state-store"],"backgroundTag":"keystore-read-failed","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T12:17:11.808Z"}