{"record":{"id":"cb3c33fffde1af4a","repo":"kubernetes/kops","slug":"wrong-signer-expected-q-got-q","errorCode":null,"errorMessage":"wrong signer: expected %q got %q","messagePattern":"wrong signer: expected %q got %q","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"upup/pkg/fi/nodeup/nodetasks/issue_cert.go","lineNumber":211,"sourceCode":"\nfunc (a asBytesResource) Open() (io.Reader, error) {\n\tdata, err := a.AsBytes()\n\tif err != nil {\n\t\treturn nil, err\n\t}\n\treturn bytes.NewReader(data), nil\n}\n\ntype staticKeystore struct {\n\tkeyset      string\n\tcertificate *pki.Certificate\n\tkey         *pki.PrivateKey\n}\n\n// FindPrimaryKeypair implements pki.Keystore\nfunc (s staticKeystore) FindPrimaryKeypair(ctx context.Context, name string) (*pki.Certificate, *pki.PrivateKey, error) {\n\tif name != s.keyset {\n\t\treturn nil, nil, fmt.Errorf(\"wrong signer: expected %q got %q\", s.keyset, name)\n\t}\n\treturn s.certificate, s.key, nil\n}\n\nfunc newStaticKeystore(ctx context.Context, signer string, keypairID string, keystore fi.KeystoreReader) (pki.Keystore, error) {\n\tif signer == \"\" {\n\t\treturn nil, nil\n\t}\n\n\tif keypairID == \"\" {\n\t\treturn nil, fmt.Errorf(\"missing keypairID for signer %s\", signer)\n\t}\n\n\tkeyset, err := keystore.FindKeyset(ctx, signer)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"reading keyset for %s: %v\", signer, err)\n\t}\n\tif keyset == nil {","sourceCodeStart":193,"sourceCodeEnd":229,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/upup/pkg/fi/nodeup/nodetasks/issue_cert.go#L193-L229","documentation":"staticKeystore.FindPrimaryKeypair (pki.Keystore implementation used by issue_cert during nodeup) only holds one keyset, so any request for a different signer name is rejected with this mismatch message naming expected vs got. It protects against signing a certificate with the wrong authority.","triggerScenarios":"IssueCert task asks pki to sign with a signer name that differs from the one the static keystore was constructed with in newStaticKeystore.","commonSituations":"Signer name typo or renamed keyset (e.g. 'kubernetes-ca' vs 'kubernetes-master-certificate-authority') between cluster spec and stored keyset; task requesting the wrong signer after an upgrade.","solutions":["Compare the 'got' name in the error with the keyset names in the cluster's keypairs","Correct the Signer field on the IssueCert task to match the actual keyset name","If the signer was renamed, migrate/update the stored keyset reference","Re-pull latest nodeup/cluster spec so signer names agree"],"exampleFix":"// before\nSigner: fi.String(\"kubernetes-ca\")\n// after\nSigner: fi.String(\"kubernetes-master-certificate-authority\") // matches stored keyset","handlingStrategy":"validation","validationCode":"// validate signer name against stored keysets before issuing\nkeysets, _ := keystoreReader.ListKeysets(ctx)\nif !slices.Contains(keysets, signerName) {\n  return fmt.Errorf(\"unknown signer %q; have %v\", signerName, keysets)\n}","typeGuard":null,"tryCatchPattern":"cert, key, err := keystore.FindPrimaryKeypair(ctx, name)\nif err != nil && strings.HasPrefix(err.Error(), \"wrong signer:\") {\n  return fmt.Errorf(\"task signer %q not in keystore: %w\", name, err)\n}","preventionTips":["Use kops's canonical signer name constants instead of literals","Grep the cluster spec for the exact keyset name after upgrades","Add a startup check that task signers exist in the keyset store"],"tags":["nodeup","pki","signer-mismatch"],"backgroundTag":"signer-name-mismatch","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T12:17:11.808Z"}