{"record":{"id":"7d9a37deec0c4956","repo":"kubernetes/kops","slug":"private-key-q-not-found","errorCode":null,"errorMessage":"private key %q not found","messagePattern":"private key %q not found","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"nodeup/pkg/model/context.go","lineNumber":428,"sourceCode":"\n\t\tcert, err := certificate.AsString()\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\n\t\tctx.AddTask(&nodetasks.File{\n\t\t\tPath:           p + \".crt\",\n\t\t\tContents:       fi.NewStringResource(cert),\n\t\t\tType:           nodetasks.FileType_File,\n\t\t\tMode:           s(\"0600\"),\n\t\t\tOwner:          owner,\n\t\t\tBeforeServices: beforeServices,\n\t\t})\n\t}\n\n\tprivateKey := item.PrivateKey\n\tif privateKey == nil {\n\t\treturn fmt.Errorf(\"private key %q not found\", name)\n\t}\n\n\tkey, err := privateKey.AsString()\n\tif err != nil {\n\t\treturn err\n\t}\n\n\tctx.AddTask(&nodetasks.File{\n\t\tPath:     p + \".key\",\n\t\tContents: fi.NewStringResource(key),\n\t\tType:     nodetasks.FileType_File,\n\t\tMode:     s(\"0600\"),\n\t\tOwner:    owner,\n\t})\n\n\treturn nil\n}\n","sourceCodeStart":410,"sourceCodeEnd":446,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/nodeup/pkg/model/context.go#L410-L446","documentation":"The keyset item exists (and has a certificate when requested) but item.PrivateKey is nil, so buildCertificatePairTask cannot write the .key file. Only the certificate half of the keypair is present in the keystore.","triggerScenarios":"item.PrivateKey is nil in BuildCertificatePairTask or BuildPrivateKeyTask — keypair items that contain only a public certificate (e.g. CA keysets imported without private keys, or the CA's private key intentionally withheld) being used where a private key file is required.","commonSituations":"CA keysets whose private keys are stored only on control-plane / never distributed; state-store restore keeping public parts only; writing private-key files for a keyset that legitimately has no private key.","solutions":["Verify the keypair includes a private key via `kops get keypairs <name> -o yaml`; re-issue with `kops create keypair <name>` if missing","If this is a public-only keyset, switch the builder call to BuildCertificateTask (cert only) instead of BuildCertificatePairTask/BuildPrivateKeyTask","Restore the private key from backup or re-create the keyset in the state store","Check that the requested keypair ID isn't pointing at a cert-only item in keyset.Items"],"exampleFix":null,"handlingStrategy":"validation","validationCode":"item := keyset.Items[keypairID]\nif item == nil || item.PrivateKey == nil {\n    return fmt.Errorf(\"keypair %s/%s has no private key; use BuildCertificateTask for cert-only keysets or re-issue\", name, keypairID)\n}","typeGuard":null,"tryCatchPattern":"if err := c.BuildPrivateKeyTask(ctx, name, path, filename, owner, nil); err != nil {\n    if strings.Contains(err.Error(), \"private key\") {\n        klog.Errorf(\"keyset %s lacks a private key; ensure it was created with 'kops create keypair'\", name)\n    }\n    return err\n}","preventionTips":["Confirm private keys exist for keysets that nodes must write key files from","Understand which keysets are public-only (e.g. some CAs) and never call BuildPrivateKeyTask on them","Recreate keypairs via kops CLI after restores","Audit keyset completeness after migrations"],"tags":["go","nodeup","private-key","keystore"],"backgroundTag":"incomplete-keypair","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T12:17:11.808Z"}