{"record":{"id":"912f28ec34090c6c","repo":"kubernetes/kops","slug":"error-fetching-ca-keypair-v","errorCode":null,"errorMessage":"error fetching CA keypair: %v","messagePattern":"error fetching CA keypair: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/kubeconfig/create_kubecfg.go","lineNumber":157,"sourceCode":"\t}\n\n\tb := NewKubeconfigBuilder()\n\n\t// Use the secondary load balancer port if a certificate is on the primary listener\n\tif options.Admin != 0 && cluster.Spec.API.LoadBalancer != nil && cluster.Spec.API.LoadBalancer.SSLCertificate != \"\" && cluster.Spec.API.LoadBalancer.Class == kops.LoadBalancerClassNetwork {\n\t\tserver = server + \":8443\"\n\t}\n\n\tb.Context = clusterName\n\tb.Server = server\n\tb.TLSServerName = cluster.APIInternalName()\n\n\t// add the CA Cert to the kubeconfig only if we didn't specify a certificate for the LB\n\t//  or if we're using admin credentials and the secondary port\n\tif cluster.Spec.API.LoadBalancer == nil || cluster.Spec.API.LoadBalancer.SSLCertificate == \"\" || cluster.Spec.API.LoadBalancer.Class == kops.LoadBalancerClassNetwork || options.Internal {\n\t\tkeySet, err := keyStore.FindKeyset(ctx, fi.CertificateIDCA)\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"error fetching CA keypair: %v\", err)\n\t\t}\n\t\tif keySet != nil {\n\t\t\tb.CACerts, err = keySet.ToCertificateBytes()\n\t\t\tif err != nil {\n\t\t\t\treturn nil, err\n\t\t\t}\n\t\t} else {\n\t\t\treturn nil, fmt.Errorf(\"cannot find CA certificate\")\n\t\t}\n\t}\n\n\tif options.Admin != 0 {\n\t\tcn := \"kubecfg\"\n\t\tuser, err := user.Current()\n\t\tif err != nil || user == nil {\n\t\t\tklog.Infof(\"unable to get user: %v\", err)\n\t\t} else {\n\t\t\tcn += \"-\" + user.Name","sourceCodeStart":139,"sourceCodeEnd":175,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/pkg/kubeconfig/create_kubecfg.go#L139-L175","documentation":"Looking up the 'ca' keyset in the cluster's keystore failed while adding the CA certificate to kubeconfig; a state-store read error (permissions, missing pki path) rather than simple absence — absence is reported by the sibling 'cannot find CA certificate' error.","triggerScenarios":"Thrown at pkg/kubeconfig/create_kubecfg.go:157 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Verify the pki/ca keyset exists in the state store","Check state-store read permissions","Retry after resolving state-store access"],"exampleFix":null,"handlingStrategy":"retry","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T07:17:12.445Z"}