{"record":{"id":"73d8ba0c0b1be36b","repo":"kubernetes/kops","slug":"public-key-s-v","errorCode":null,"errorMessage":"public key %s: %v","messagePattern":"public key (.+?): (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"upup/pkg/fi/ca.go","lineNumber":150,"sourceCode":"\nfunc (k *Keyset) ToCertificateBytes() ([]byte, error) {\n\tkeys := make([]string, 0, len(k.Items))\n\tfor k, item := range k.Items {\n\t\tif item.DistrustTimestamp == nil {\n\t\t\tkeys = append(keys, k)\n\t\t}\n\t}\n\tsort.Slice(keys, func(i, j int) bool {\n\t\treturn KeysetItemIdOlder(k.Items[keys[i]].Id, k.Items[keys[j]].Id)\n\t})\n\n\tbuf := new(bytes.Buffer)\n\tfor _, key := range keys {\n\t\titem := k.Items[key]\n\t\tif item.Certificate != nil {\n\t\t\tcertificate, err := item.Certificate.AsBytes()\n\t\t\tif err != nil {\n\t\t\t\treturn nil, fmt.Errorf(\"public key %s: %v\", item.Id, err)\n\t\t\t}\n\t\t\tbuf.Write(certificate)\n\t\t}\n\t}\n\treturn buf.Bytes(), nil\n}\n\nfunc (k *Keyset) ToPublicKeys() (string, error) {\n\tkeys := make([]string, 0, len(k.Items))\n\tfor k, item := range k.Items {\n\t\tif item.DistrustTimestamp == nil {\n\t\t\tkeys = append(keys, k)\n\t\t}\n\t}\n\tsort.Slice(keys, func(i, j int) bool {\n\t\treturn KeysetItemIdOlder(k.Items[keys[i]].Id, k.Items[keys[j]].Id)\n\t})\n","sourceCodeStart":132,"sourceCodeEnd":168,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/upup/pkg/fi/ca.go#L132-L168","documentation":"Keyset.ToCertificateBytes serializes the certificate of every item in a keyset into one buffer. If item.Certificate.AsBytes() fails for any keyset item, it returns 'public key %s: %v' where %s is the keyset item id — meaning a stored certificate cannot be re-encoded (typically malformed PEM/DER data in the underlying store).","triggerScenarios":"setResources -> Keyset.ToCertificateBytes when an item in the keyset holds a Certificate whose AsBytes encoding fails — corrupted or unsupported certificate data in the backing store (e.g. file-backed or keyset store).","commonSituations":"Manually edited or partially written certificate files in the keyset store; a migration/version change left an item in an incompatible format; truncated write during an earlier failed update.","solutions":["Identify the failing item from %s (item id) and inspect the certificate it references in the keyset store.","Replace the bad certificate with a freshly issued one (kOps replace/rotate secret or re-run cluster CA/cert creation).","Restore the keyset from backup/state store history if corruption is recent.","Re-encode/validate the cert with openssl x509 to confirm it parses before re-importing."],"exampleFix":"// validate the stored certificate out-of-band\n$ openssl x509 -in <item-cert>.pem -noout -text   # rejects the corrupt item\n# then re-issue/rotate the certificate via kOps and re-run","handlingStrategy":"try-catch","validationCode":"$ openssl x509 -in <item-cert>.pem -noout -text   # must parse cleanly before use\n$ openssl x509 -in <item-cert>.pem -noout -enddate  # also confirm not expired","typeGuard":"function isCertNil(item: { Certificate: object | null }): item is { Certificate: null } { return item.Certificate === null }","tryCatchPattern":"try {\n  const bytes = keyset.toCertificateBytes()\n} catch (e) {\n  if (/public key .*: /.test(e.message)) {\n    const itemId = e.message.match(/public key (\\S+):/)?.[1] // locate corrupt item\n    console.error(\"corrupt certificate in keyset item:\", itemId)\n    // replace/rotate that item's certificate and retry\n  }\n  throw e\n}","preventionTips":["Never hand-edit files inside the keyset store.","Validate certificates with openssl before importing.","Back up the state store so corrupt keysets can be restored.","Use kOps rotation commands instead of manual writes."],"tags":["pki","certificates","keyset"],"backgroundTag":"certificate-encoding-failed","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T07:17:12.445Z"}