{"record":{"id":"9cdadc9f18a579c2","repo":"kubernetes/kops","slug":"control-plane-nodes-can-t-get-certs-from-kops-cont","errorCode":null,"errorMessage":"control plane nodes can't get certs from kops-controller","messagePattern":"control plane nodes can't get certs from kops-controller","errorType":"panic","errorClass":null,"httpStatus":null,"severity":"error","filePath":"nodeup/pkg/model/context.go","lineNumber":259,"sourceCode":"\t\tName: name,\n\t\tCert: certResource,\n\t\tKey:  keyResource,\n\t\tCA:   caResource,\n\t}\n\tif c.HasAPIServer {\n\t\t// @note: use https even for local connections, so we can turn off the insecure port\n\t\tkubeConfig.ServerURL = \"https://127.0.0.1\"\n\t} else {\n\t\tkubeConfig.ServerURL = \"https://\" + c.APIInternalName()\n\t}\n\tctx.AddTask(kubeConfig)\n\treturn kubeConfig.GetConfig()\n}\n\n// GetBootstrapCert requests a certificate keypair from kops-controller.\nfunc (c *NodeupModelContext) GetBootstrapCert(name string, signer string) (cert, key fi.Resource, err error) {\n\tif c.IsMaster {\n\t\tpanic(\"control plane nodes can't get certs from kops-controller\")\n\t}\n\tb, ok := c.bootstrapCerts[name]\n\tif !ok {\n\t\tb = &nodetasks.BootstrapCert{\n\t\t\tCert: &fi.NodeupTaskDependentResource{},\n\t\t\tKey:  &fi.NodeupTaskDependentResource{},\n\t\t}\n\t\tc.bootstrapCerts[name] = b\n\t}\n\tc.bootstrapKeypairIDs[signer] = c.NodeupConfig.KeypairIDs[signer]\n\tif c.bootstrapKeypairIDs[signer] == \"\" {\n\t\treturn nil, nil, fmt.Errorf(\"no keypairID for %q\", signer)\n\t}\n\treturn b.Cert, b.Key, nil\n}\n\n// BuildBootstrapKubeconfig generates a kubeconfig with a client certificate from either kops-controller or the state store.\nfunc (c *NodeupModelContext) BuildBootstrapKubeconfig(name string, ctx *fi.NodeupModelBuilderContext) (fi.Resource, error) {","sourceCodeStart":241,"sourceCodeEnd":277,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/nodeup/pkg/model/context.go#L241-L277","documentation":"Deliberate panic guard in NodeupModelContext.GetBootstrapCert: only worker nodes obtain keypairs from kops-controller, but IsMaster is true, meaning bootstrap-bundle logic was invoked on a control-plane node. Control-plane nodes receive their certificates through the CA/pki bundle instead, so reaching this call is a nodeup task-graph programming error, not a runtime condition.","triggerScenarios":"Thrown at nodeup/pkg/model/context.go:259 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Route control-plane nodes to the CA-based certificate tasks (nodeup/pki model) rather than GetBootstrapCert","Audit task builders (kubelet serving cert, cilium etcd secrets, bootstrap kubeconfig) for branch conditions that wrongly include masters"],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T07:17:12.445Z"}