{"record":{"id":"d43a844fc536dc16","repo":"kubernetes/kops","slug":"unknown-ca-q","errorCode":null,"errorMessage":"unknown CA %q","messagePattern":"unknown CA %q","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"cmd/kops-controller/pkg/server/keystore.go","lineNumber":49,"sourceCode":"\ntype keystore struct {\n\tkeys    map[string]keystoreEntry\n\tkeySets map[string]*fi.Keyset\n}\n\ntype keystoreEntry struct {\n\tcertificate *pki.Certificate\n\tkey         *pki.PrivateKey\n}\n\nvar _ pki.Keystore = &keystore{}\nvar _ fi.CAStore = &keystore{}\n\n// FindPrimaryKeypair implements pki.Keystore\nfunc (k *keystore) FindPrimaryKeypair(ctx context.Context, name string) (*pki.Certificate, *pki.PrivateKey, error) {\n\tentry, ok := k.keys[name]\n\tif !ok {\n\t\treturn nil, nil, fmt.Errorf(\"unknown CA %q\", name)\n\t}\n\treturn entry.certificate, entry.key, nil\n}\n\n// FindKeyset finds a Keyset.  If the keyset is not found, it returns (nil, nil).\nfunc (k *keystore) FindKeyset(ctx context.Context, name string) (*fi.Keyset, error) {\n\tkeySet, ok := k.keySets[name]\n\tif !ok {\n\t\treturn nil, nil\n\t}\n\treturn keySet, nil\n}\n\n// StoreKeyset writes a Keyset to the store.\nfunc (k *keystore) StoreKeyset(ctx context.Context, name string, keyset *fi.Keyset) error {\n\treturn fmt.Errorf(\"server-side client does not support StoreKeyset\")\n}\n","sourceCodeStart":31,"sourceCodeEnd":67,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/cmd/kops-controller/pkg/server/keystore.go#L31-L67","documentation":"The kops-controller server keystore is an in-memory CA store preloaded at startup from a filesystem PKI directory (one <name>.crt / <name>.key pair per configured CA). FindPrimaryKeypair throws \"unknown CA %q\" when it is asked for a CA name that was never loaded into that map — i.e. the requested CA is not one of the CAs this controller instance was configured to serve.","triggerScenarios":"A request path (e.g. issue-cert / pki.Keystore lookup via FindPrimaryKeypair) names a CA that is absent from k.keys: the CA was not listed in the controller's --ca-values/configured CAs at startup, the <name>.crt/<name>.key files were missing in basePath, or a client (kops-controller client/nodeup) requests a keypair for a CA name the server does not serve (e.g. etcd-manager CAs, which are intentionally not loaded).","commonSituations":"A node requests a certificate for a CA the controller was not started with (misconfigured controller flags); a new CA type was added in a newer kOps version but the controller still runs an older version with a narrower CA list; files in the PKI basePath were renamed or removed so the CA silently failed to load (actually failing earlier in newKeystore) or was never configured.","solutions":["Check which CAs the controller was started with (the `cas` list passed to newKeystore) and confirm the requested CA name is among them","Verify basePath contains <name>.crt and <name>.key for the requested CA and that newKeystore loaded it (startup would have failed otherwise)","Align the client: ensure the requesting node/feature only requests CAs the controller serves; etcd-manager CAs are deliberately not served server-side","Upgrade kops-controller to match the kOps version of the cluster if a newer feature requests a newly introduced CA"],"exampleFix":"// before: client requests a CA the controller does not serve\nkp, err := client.FindPrimaryKeypair(ctx, \"etcd-clients-ca\")\n\n// after: request a served CA, or load the CA server-side\nkp, err := client.FindPrimaryKeypair(ctx, \"kubernetes-ca\")","handlingStrategy":"validation","validationCode":"// Before requesting, check the CA is in the controller's configured list\ncas, err := serverKeystoreConfiguredCAs() // e.g. from controller config / keypair-ids.yaml\nif !slices.Contains(cas, caName) {\n\treturn fmt.Errorf(\"CA %q is not served by this controller (served: %v)\", caName, cas)\n}","typeGuard":"func isUnknownCA(err error) bool {\n\treturn err != nil && strings.Contains(err.Error(), \"unknown CA \")\n}","tryCatchPattern":"cert, key, err := ks.FindPrimaryKeypair(ctx, caName)\nif err != nil {\n\tif isUnknownCA(err) {\n\t\t// fall back to cluster keystore or skip this CA\n\t\treturn fallbackKeystore.FindPrimaryKeypair(ctx, caName)\n\t}\n\treturn err\n}","preventionTips":["Keep the client's CA request list in sync with the controller's configured `cas`","Never request etcd-manager/etcd CAs from the server-side keystore; they are intentionally not loaded","Pin kops-controller and nodeup to the same kOps version","Check controller startup logs to confirm which CAs loaded successfully before issuing requests"],"tags":["pki","ca","keystore","kops-controller"],"backgroundTag":"unknown-ca","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T07:17:12.445Z"}