{"record":{"id":"93020a18cd1c26b5","repo":"kubernetes/kops","slug":"error-creating-discovery-ca-w","errorCode":null,"errorMessage":"error creating discovery CA: %w","messagePattern":"error creating discovery CA: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"upup/pkg/fi/cloudup/new_cluster.go","lineNumber":1791,"sourceCode":"\n// discoveryUniverseID returns the universe ID for the cluster's discovery service,\n// creating a new discovery CA if necessary.\nfunc discoveryUniverseID(ctx context.Context, keystore fi.Keystore) (string, error) {\n\tkeyset, err := keystore.FindKeyset(ctx, fi.DiscoveryCAID)\n\tif err != nil {\n\t\treturn \"\", fmt.Errorf(\"error finding discovery CA: %w\", err)\n\t}\n\n\tif keyset == nil || keyset.Primary == nil || keyset.Primary.Certificate == nil {\n\t\tsubject := pkix.Name{\n\t\t\tCommonName: fi.DiscoveryCAID,\n\t\t}\n\t\tkeyset, err = fitasks.CreateKeyset(ctx, keystore, fi.DiscoveryCAID, pki.IssueCertRequest{\n\t\t\tSubject: subject,\n\t\t\tType:    \"ca\",\n\t\t})\n\t\tif err != nil {\n\t\t\treturn \"\", fmt.Errorf(\"error creating discovery CA: %w\", err)\n\t\t}\n\t}\n\n\tif keyset == nil || keyset.Primary == nil || keyset.Primary.Certificate == nil || keyset.Primary.Certificate.Certificate == nil {\n\t\treturn \"\", fmt.Errorf(\"discovery CA creation failed\")\n\t}\n\n\treturn discoveryapi.ComputeUniverseIDFromCertificate(keyset.Primary.Certificate.Certificate), nil\n}\n","sourceCodeStart":1773,"sourceCodeEnd":1801,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/upup/pkg/fi/cloudup/new_cluster.go#L1773-L1801","documentation":"When no discovery CA exists, discoveryUniverseID creates one via fitasks.CreateKeyset with an IssueCertRequest of type \"ca\"; if issuance fails this wrapped error is returned. It means the CA generation/write to the keystore failed.","triggerScenarios":"First cluster creation where the discovery CA does not yet exist and CreateKeyset fails: keystore write permission denied, backend conflict/concurrent creation, crypto issuance failure.","commonSituations":"Read-only state store credentials during create; two kops processes racing to create the same CA; backend quota or throttling errors.","solutions":["Ensure the state-store credentials allow writes","Retry — transient backend errors are often resolved on re-run (idempotent keyset creation)","Check for concurrent kops runs against the same cluster state and run one at a time"],"exampleFix":null,"handlingStrategy":"retry","validationCode":"// ensure credentials allow writes to the keystore path\nif !canWrite(stateStore) {\n    return errors.New(\"state store is read-only; cannot create discovery CA\")\n}","typeGuard":null,"tryCatchPattern":"keyset, err := fitasks.CreateKeyset(ctx, keystore, fi.DiscoveryCAID, req)\nif err != nil {\n    if isConflictOrThrottle(err) {\n        // retry after backoff\n    }\n    return err\n}","preventionTips":["Use writable credentials for create/upgrade","Avoid concurrent kops runs on the same cluster"],"tags":["pki","ca","keystore"],"backgroundTag":"ca-creation-failed","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T07:17:12.445Z"}