{"record":{"id":"a7fc561fc3d1964f","repo":"kubernetes/kops","slug":"found-pki-volume-but-hostpath-was-nil","errorCode":null,"errorMessage":"found PKI volume, but HostPath was nil","messagePattern":"found PKI volume, but HostPath was nil","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/model/components/etcdmanager/model.go","lineNumber":651,"sourceCode":"\n\t\tfor _, envVar := range etcdCluster.Manager.Env {\n\t\t\tklog.V(2).Infof(\"overloading ENV var in manifest %s with %s=%s\", bundle, envVar.Name, envVar.Value)\n\t\t\tconfigOverwrite := v1.EnvVar{\n\t\t\t\tName:  envVar.Name,\n\t\t\t\tValue: envVar.Value,\n\t\t\t}\n\n\t\t\tcontainer.Env = append(container.Env, configOverwrite)\n\t\t}\n\t}\n\n\t{\n\t\tfoundPKI := false\n\t\tfor i := range pod.Spec.Volumes {\n\t\t\tv := &pod.Spec.Volumes[i]\n\t\t\tif v.Name == \"pki\" {\n\t\t\t\tif v.HostPath == nil {\n\t\t\t\t\treturn nil, fmt.Errorf(\"found PKI volume, but HostPath was nil\")\n\t\t\t\t}\n\t\t\t\tdirname := \"etcd-manager-\" + etcdCluster.Name\n\t\t\t\tv.HostPath.Path = \"/etc/kubernetes/pki/\" + dirname\n\t\t\t\tfoundPKI = true\n\t\t\t}\n\t\t}\n\t\tif !foundPKI {\n\t\t\treturn nil, fmt.Errorf(\"did not find PKI volume\")\n\t\t}\n\t}\n\n\tkubemanifest.MarkPodAsCritical(pod)\n\tkubemanifest.MarkPodAsClusterCritical(pod)\n\n\treturn pod, nil\n}\n\nfunc linodeVolumeSelectors(clusterName, etcdClusterName, instanceGroupName string) ([]string, string) {","sourceCodeStart":633,"sourceCodeEnd":669,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/pkg/model/components/etcdmanager/model.go#L633-L669","documentation":"After assembling the etcd-manager pod, kOps post-processes it and expects a hostPath volume named \"pki\" (used to expose /etc/kubernetes/pki to the etcd-manager container). If that volume exists but its HostPath field is nil (e.g. it was created as some other volume type), buildPod returns this error. It is a consistency check on the generated pod spec.","triggerScenarios":"kops update cluster with pki volume generation producing a non-hostPath volume — typically caused by an internal model-build bug, a patch/hook mutating the pod manifest, or a corrupted template.","commonSituations":"Hit when using kOps builds with customized component templates, external manifest mutation tooling, or during kOps version regressions.","solutions":["Upgrade/downgrade kOps to a stable release where the pki volume is generated as a HostPath volume","Remove any hooks or patches that modify the etcd-manager pod volumes","Report the issue with kops version and the generated manifest (kops get --full) if it persists"],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":"// Defend around pod post-processing\npod, err := buildPod(ctx, b, etcdCluster)\nif err != nil {\n    if strings.Contains(err.Error(), \"PKI volume\") {\n        klog.Warning(\"etcd-manager pki volume generation failed; likely kOps bug — check version\")\n    }\n    return err\n}","preventionTips":["Avoid tools/hooks that mutate generated pod volumes","Use official kOps releases rather than patched forks","Verify generated manifests with kops update cluster --out before applying"],"tags":["etcd-manager","pki","pod-volumes"],"backgroundTag":"pki-volume-misconfigured","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T12:17:11.808Z"}