{"record":{"id":"af5e0e3240b438df","repo":"kubernetes/kops","slug":"error-building-kubelet-server-cert-v","errorCode":null,"errorMessage":"error building kubelet server cert: %v","messagePattern":"error building kubelet server cert: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"nodeup/pkg/model/kubelet.go","lineNumber":106,"sourceCode":"\tinfo, ok := runtime.SerializerInfoForMediaType(codecFactory.SupportedMediaTypes(), \"application/yaml\")\n\tif !ok {\n\t\tpanic(fmt.Sprintf(\"no YAML serializer registered for kubelet scheme %v\", gv))\n\t}\n\treturn codecFactory.EncoderForVersion(info.Serializer, gv)\n}\n\n// KubeletBuilder installs kubelet\ntype KubeletBuilder struct {\n\t*NodeupModelContext\n}\n\nvar _ fi.NodeupModelBuilder = &KubeletBuilder{}\n\n// Build is responsible for building the kubelet configuration\nfunc (b *KubeletBuilder) Build(c *fi.NodeupModelBuilderContext) error {\n\terr := b.buildKubeletServingCertificate(c)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"error building kubelet server cert: %v\", err)\n\t}\n\n\tctx := c.Context()\n\tkubeletConfig, err := b.buildKubeletConfigSpec(ctx)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"error building kubelet config: %v\", err)\n\t}\n\n\t{\n\t\t// Set the provider ID to help speed node registration on large clusters\n\t\tvar providerID string\n\t\tif b.CloudProvider() == kops.CloudProviderAWS {\n\t\t\tconfig, err := awsconfig.LoadDefaultConfig(ctx)\n\t\t\tif err != nil {\n\t\t\t\treturn fmt.Errorf(\"error loading AWS config: %v\", err)\n\t\t\t}\n\t\t\tmetadata := imds.NewFromConfig(config)\n\t\t\tinstanceIdentity, err := metadata.GetInstanceIdentityDocument(ctx, &imds.GetInstanceIdentityDocumentInput{})","sourceCodeStart":88,"sourceCodeEnd":124,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/nodeup/pkg/model/kubelet.go#L88-L124","documentation":"KubeletBuilder.Build wraps failures from buildKubeletServingCertificate with this message. That helper provisions the kubelet server serving certificate/key tasks; any error generating, finding, or storing the cert in the nodeup context is reported here.","triggerScenarios":"buildKubeletServingCertificate fails, e.g. missing kubelet server certificate in the keystore, missing private key, or failure creating the alternate-names/task for the serving cert.","commonSituations":"Node bootstrap where the kubelet server cert was never issued (PKI misconfig), keys not distributed to the node, or SSL/keystore path problems during nodeup model building.","solutions":["Read the wrapped inner error for the root cause (missing cert vs key vs store access).","Re-run kops update/rolling-update to regenerate and redistribute kubelet server certificates.","Check that the node can access the keystore/SSL paths where the serving cert is stored.","Verify cluster PKI (CA) configuration in the cluster spec is intact."],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":"err := runNodeup(ctx)\nif err != nil {\n    var pathErr *fs.PathError\n    if errors.As(err, &pathErr) {\n        // certificate/key path unreadable: fix keystore permissions and retry\n    }\n    return fmt.Errorf(\"nodeup kubelet cert stage failed: %w\", err)\n}","preventionTips":["Keep the CA and kubelet server cert issuance in the standard kops PKI flow; avoid hand-editing pki stores.","Roll nodes with kops rolling-update so certs are regenerated in order.","Monitor nodeup logs for certificate errors before they block bootstrap."],"tags":["nodeup","kubelet","tls","certificates"],"backgroundTag":"certificate-provisioning-failed","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T07:17:12.445Z"}