{"record":{"id":"5b83c6bf16439319","repo":"kubernetes/kubernetes","slug":"failed-to-init-kubernetes-io-kube-apiserver-client-5b83c6","errorCode":null,"errorMessage":"failed to init kubernetes.io/kube-apiserver-client certificate controller: %w","messagePattern":"failed to init kubernetes\\.io/kube-apiserver-client certificate controller: %w","errorType":"console","errorClass":null,"httpStatus":null,"severity":"error","filePath":"cmd/kube-controller-manager/app/certificates.go","lineNumber":104,"sourceCode":"\t}\n\n\tif kubeletClientSignerCertFile, kubeletClientSignerKeyFile := getKubeletClientSignerFiles(controllerContext.ComponentConfig.CSRSigningController); len(kubeletClientSignerCertFile) > 0 || len(kubeletClientSignerKeyFile) > 0 {\n\t\tkubeletClientSigner, err := signer.NewKubeletClientCSRSigningController(ctx, c, csrInformer, kubeletClientSignerCertFile, kubeletClientSignerKeyFile, certTTL)\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"failed to init kubernetes.io/kube-apiserver-client-kubelet certificate controller: %w\", err)\n\t\t}\n\n\t\trx = append(rx, func(ctx context.Context) {\n\t\t\tkubeletClientSigner.Run(ctx, 5)\n\t\t})\n\t} else {\n\t\tlogger.Info(\"Skipping CSR signer controller because specific files were specified for other signers and not this one\", \"controller\", \"kubernetes.io/kube-apiserver-client-kubelet\")\n\t}\n\n\tif kubeAPIServerSignerCertFile, kubeAPIServerSignerKeyFile := getKubeAPIServerClientSignerFiles(controllerContext.ComponentConfig.CSRSigningController); len(kubeAPIServerSignerCertFile) > 0 || len(kubeAPIServerSignerKeyFile) > 0 {\n\t\tkubeAPIServerClientSigner, err := signer.NewKubeAPIServerClientCSRSigningController(ctx, c, csrInformer, kubeAPIServerSignerCertFile, kubeAPIServerSignerKeyFile, certTTL)\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"failed to init kubernetes.io/kube-apiserver-client certificate controller: %w\", err)\n\t\t}\n\n\t\trx = append(rx, func(ctx context.Context) {\n\t\t\tkubeAPIServerClientSigner.Run(ctx, 5)\n\t\t})\n\t} else {\n\t\tlogger.Info(\"Skipping CSR signer controller because specific files were specified for other signers and not this one\", \"controller\", \"kubernetes.io/kube-apiserver-client\")\n\t}\n\n\tif legacyUnknownSignerCertFile, legacyUnknownSignerKeyFile := getLegacyUnknownSignerFiles(controllerContext.ComponentConfig.CSRSigningController); len(legacyUnknownSignerCertFile) > 0 || len(legacyUnknownSignerKeyFile) > 0 {\n\t\tlegacyUnknownSigner, err := signer.NewLegacyUnknownCSRSigningController(ctx, c, csrInformer, legacyUnknownSignerCertFile, legacyUnknownSignerKeyFile, certTTL)\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"failed to init kubernetes.io/legacy-unknown certificate controller: %w\", err)\n\t\t}\n\n\t\trx = append(rx, func(ctx context.Context) {\n\t\t\tlegacyUnknownSigner.Run(ctx, 5)\n\t\t})","sourceCodeStart":86,"sourceCodeEnd":122,"githubUrl":"https://github.com/kubernetes/kubernetes/blob/b882c60b4023bdf09264c2d5d30a2cadebc240fb/cmd/kube-controller-manager/app/certificates.go#L86-L122","documentation":"When the kube-apiserver-client signer files are configured, signer.NewKubeAPIServerClientCSRSigningController builds the signer that signs CSRs of type kubernetes.io/kube-apiserver-client. A returned error aborts construction of the CSR signing controller.","triggerScenarios":"certificates.go:102 calls signer.NewKubeAPIServerClientCSRSigningController(ctx, c, csrInformer, certFile, keyFile, certTTL). It errors when the cert/key pair cannot be loaded/parsed, the pair does not match, or the files are unreadable.","commonSituations":"Misconfigured --cluster-signing-kube-apiserver-client-cert-file/--cluster-signing-kube-apiserver-client-key-file (or default pair) with missing/unreadable/mismatched files. PEM corruption, permission errors.","solutions":["Verify the kube-apiserver-client signing cert and key files exist and are readable.","Confirm the cert/key pair matches (compare modulus).","Read the wrapped %w for the specific TLS error.","Regenerate the pair together and restart kube-controller-manager."],"exampleFix":null,"handlingStrategy":"validation","validationCode":"# Pre-flight: validate the kube-apiserver-client signing pair.\nCERT=/etc/kubernetes/pki/apiserver-client-ca.crt  # --cluster-signing-kube-apiserver-client-cert-file\nKEY=/etc/kubernetes/pki/apiserver-client-ca.key   # --cluster-signing-kube-apiserver-client-key-file\nopenssl x509 -in \"$CERT\" -noout >/dev/null 2>&1 || { echo \"bad cert\" >&2; exit 1; }\nopenssl rsa  -in \"$KEY\"  -noout >/dev/null 2>&1 || { echo \"bad key\" >&2; exit 1; }\n[ \"$(openssl x509 -in \"$CERT\" -noout -modulus | openssl md5)\" = \"$(openssl rsa -in \"$KEY\" -noout -modulus | openssl md5)\" ] \\\n  || { echo \"cert/key mismatch\" >&2; exit 1; }","typeGuard":null,"tryCatchPattern":"signer, err := signer.NewKubeAPIServerClientCSRSigningController(ctx, c, csrInformer, certFile, keyFile, certTTL)\nif err != nil {\n    return nil, fmt.Errorf(\"failed to init kubernetes.io/kube-apiserver-client certificate controller: %w\", err)\n}","preventionTips":["Deploy signing cert and key as an atomic pair.","Add a modulus-compare check to deploy scripts.","Keep file permissions correct for the controller-manager uid."],"tags":["certificates","csr","signing","kube-apiserver-client","tls","kube-controller-manager"],"analyzedSha":"b882c60b4023bdf09264c2d5d30a2cadebc240fb","analyzedAt":"2026-08-07T04:07:48.144Z","schemaVersion":2},"datasetVersion":"2026-08-07T07:17:06.508Z"}