{"record":{"id":"6377a8814770d9d9","repo":"kubernetes/kops","slug":"issuing-certificate-v","errorCode":null,"errorMessage":"issuing certificate: %v","messagePattern":"issuing certificate: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"cmd/kops-controller/pkg/server/server.go","lineNumber":351,"sourceCode":"\t\t}\n\tcase \"kube-router\":\n\t\tissueReq.Subject = pkix.Name{\n\t\t\tCommonName: rbac.KubeRouter,\n\t\t}\n\tdefault:\n\t\treturn \"\", fmt.Errorf(\"unexpected key name\")\n\t}\n\n\t// This field was added to the protocol in kOps 1.22.\n\tif len(keypairIDs) > 0 {\n\t\tif keypairIDs[issueReq.Signer] != s.keypairIDs[issueReq.Signer] {\n\t\t\treturn \"\", fmt.Errorf(\"request's keypair ID %q for %s didn't match server's %q\", keypairIDs[issueReq.Signer], issueReq.Signer, s.keypairIDs[issueReq.Signer])\n\t\t}\n\t}\n\n\tcert, _, _, err := pki.IssueCert(ctx, issueReq, s.keystore)\n\tif err != nil {\n\t\treturn \"\", fmt.Errorf(\"issuing certificate: %v\", err)\n\t}\n\n\treturn cert.AsString()\n}\n\n// recovery is responsible for ensuring we don't exit on a panic.\nfunc recovery(next http.Handler) http.Handler {\n\treturn http.HandlerFunc(func(w http.ResponseWriter, req *http.Request) {\n\t\tdefer func() {\n\t\t\tif err := recover(); err != nil {\n\t\t\t\tw.WriteHeader(http.StatusInternalServerError)\n\n\t\t\t\tklog.Errorf(\"failed to handle request: threw exception: %v: %s\", err, debug.Stack())\n\t\t\t}\n\t\t}()\n\n\t\tnext.ServeHTTP(w, req)\n\t})","sourceCodeStart":333,"sourceCodeEnd":369,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/cmd/kops-controller/pkg/server/server.go#L333-L369","documentation":"issueCert delegates actual certificate issuance to pki.IssueCert against the server's keystore. Any keystore/backend failure (unreadable CA, etcd/keys store unavailable, signing error) is wrapped as \"issuing certificate: %v\".","triggerScenarios":"pki.IssueCert returns an error: CA keypair missing or unreadable in the keystore, keystore backend (etcd cluster storing keys) unreachable, or invalid issue request for the backend.","commonSituations":"kops-controller cannot reach the keystore etcd cluster during node bootstrap; corrupted or missing CA in the key store; permission/backend issues after cluster restore or upgrade.","solutions":["Check kops-controller logs for the underlying wrapped cause and verify keystore etcd connectivity from the controller","Verify the CA (e.g. \"kubernetes-ca\", \"etcd-clients-ca\") exists in the keystore; re-create via `kops update cluster` if missing","Restore keys backup or re-issue CAs if the keystore is corrupted, then re-bootstrap nodes","Restart kops-controller and retry node bootstrap once the backend is healthy"],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":"// check CA exists in keystore before issuing\n_, err := keystore.FindKeypair(ctx, fi.CertificateIDCA)\nif err != nil {\n    return fmt.Errorf(\"CA keypair unavailable: %v\", err)\n}","typeGuard":null,"tryCatchPattern":"cert, _, _, err := pki.IssueCert(ctx, issueReq, s.keystore)\nif err != nil {\n    log.Printf(\"IssueCert failed: %v\", err) // inspect wrapped cause\n    return \"\", fmt.Errorf(\"issuing certificate: %v\", err)\n}","preventionTips":["Monitor kops-controller connectivity to the keystore etcd cluster","Back up the keys etcd cluster; verify CA keypairs after any restore","Alert on bootstrap endpoint failure rates","Verify CA existence after upgrades with `kops get secrets` equivalents"],"tags":["certificates","keystore","etcd","bootstrap"],"backgroundTag":"certificate-issuance-failed","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T12:17:11.808Z"}